34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5f:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T444,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 4a7344b0023d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4a7344b0023d…. Threat score 100/100. 0/25 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048"],"about":{"@type":"SoftwareApplication","name":"TiMini-Print-GUI-Windows-x86_64.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2b1f,Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "K32EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T422,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "Unknown compression method in IHDR" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp, 00000000-00006920.00000001.170129.3EEDC000.00000002.mdmp, 00000000-00006920.00000002.172052.35E6F000.00000002.mdmp, 00000000-00006920.00000003.178514.3E474000.00000002.mdmp") Found string "text compression mode is out of range" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "bad compression method" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "unknown compression type" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "bad compression info" (Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") file/memory contains long string(Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp")38:Ta2a,file/memory contains long string with (Indicator: "SHA384"; File: "_elementtree.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_asyncio.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_overlapped.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_multiprocessing.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2590000.00000004.mdmp, 00000000-00006920.00000000.168210.F2BD0000.00000004.mdmp, 00000000-00006920.00000000.168210.F3294000.00000004.mdmp, 00000000-00006920.00000001.170129.4B0D4000.00000002.mdmp, 00000000-00006920.00000001.170129.F2590000.00000004.mdmp, 00000000-00006920.00000001.170129.F3294000.00000004.mdmp, 00000000-00006920.00000002.172052.F2590000.00000004.mdmp, 00000000-00006920.00000002.172052.F2BD0000.00000004.mdmp, 00000000-00006920.00000002.172052.F3294000.00000004.mdmp, 00000000-00006920.00000003.178514.39AA2000.00000002.mdmp, 00000000-00006920.00000003.178514.4AF67000.00000002.mdmp, 00000000-00006920.00000003.178514.F237B000.00000004.mdmp, 00000000-00006920.00000003.178514.F2590000.00000004.mdmp, 00000000-00006920.00000003.178514.F2BD0000.00000004.mdmp, 00000000-00006920.00000003.178514.F3294000.00000004.mdmp, 00000000-00006920.00000003.178514.F34D5000.00000004.mdmp")39:Ta36,"TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902387837 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902395578 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902591929 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902599356 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902758038 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00008488-00000C15-902765086 [PID: 8488] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918174361 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918181606 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918373566 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918380682 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918531464 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-918539867 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-919301751 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-919308921 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-919808800 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-919816885 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-920155401 [PID: 6920] "TiMini-Print-GUI-Windows-x86_64.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-920163163 [PID: 6920] "cmd.exe" queried SystemProcessInformation at 00000000-00007892-00000C15-926241856 [PID: 7892] "cmd.exe" queried SystemProcessInformation at 00000000-00007892-00000C15-926250199 [PID: 7892] "cmd.exe" queried SystemProcessInformation at 00000000-00007892-00000C15-926444094 [PID: 7892] "cmd.exe" queried SystemProcessInformation at 00000000-00007892-00000C15-926451562 [PID: 7892]3a:T9dd0,Found XOR loop in file "VCRUNTIME140_1.dll" at offset 14812; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 35124; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 45313; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1422424; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1488536; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1639867; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2430032; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2434011; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2434150; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2487685; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2495915; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2509037; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2510941; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2525054; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2525107; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2525196; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2525986; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2864992; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3049982; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3236215; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3239311; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3902120; code bytes = 30d0 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2095867; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2201623; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2495612; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2505525; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3465297; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3469278; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3830800; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3839376; code bytes = 33c1 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3219582; code bytes = 30040e Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 463985; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 536692; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1578772; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1733587; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 1887524; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 2675450; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 3392380; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 4909353; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 4953289; code bytes = 8030 Found XOR loop in file "_avif.cp311-win_amd64.pyd" at offset 4984989; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2615988; code bytes = 30d0 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 330460; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 965444; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1401558; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1454602; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1455823; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1457295; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1457821; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1460504; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1460538; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1486986; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1486998; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1487851; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1487857; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1488178; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1488194; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1488443; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1489221; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1489428; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1489530; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1489546; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1489676; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1490695; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1491035; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1491045; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1491231; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1491445; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1544559; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1545011; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1546443; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1641941; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1642634; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1642642; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1643438; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1643581; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1644809; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1644819; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1647857; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1647945; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1647977; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1687121; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1687126; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1693783; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1693813; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1701081; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1701091; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1743409; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1743416; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1776405; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1813445; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1813467; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2400141; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2409405; code bytes = 33c1 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 794417; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 893852; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1112213; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1507726; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1843357; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 1843388; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2400768; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2410032; code bytes = 8030 Found XOR loop in file "_imaging.cp311-win_amd64.pyd" at offset 2611016; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1499857; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2067747; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2071532; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2071560; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2074523; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2076283; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2076743; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2077463; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2078523; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2080567; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2083707; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2083931; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2084223; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2084295; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2084355; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2087223; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2090727; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2090759; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2092847; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2094563; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2099096; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2099148; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2099627; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2099831; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2099923; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2100327; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2100507; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2102991; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2104011; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2107243; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2109327; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2110687; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2111591; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2113491; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2114407; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2115831; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2116695; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2117711; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2126451; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2130391; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2132983; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2136283; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2137275; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2138743; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2139967; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2146027; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2152319; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2178308; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2199248; code bytes = 30d0 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 287066; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 287072; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 315693; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 315877; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 315891; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 346276; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 346830; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 415447; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 415622; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 415635; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 415666; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 415679; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 528178; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 528185; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 569499; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 658090; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 659311; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 660783; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 661309; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 663992; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 664026; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 669106; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1005027; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1135469; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1135517; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1135643; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1135667; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1135703; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1325817; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1346221; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1346226; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1346255; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1346260; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1519106; code bytes = 33c1 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2016551; code bytes = 30040e Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 42267; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 125122; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1494923; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1497634; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1499302; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1499837; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1499856; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500042; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500130; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500301; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500312; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500833; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1500844; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1501296; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1501307; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1502380; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1503696; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1503707; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1504518; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1504539; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1504821; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1504832; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1504842; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505009; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505020; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505172; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505333; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505344; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1505939; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1506156; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1507096; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1508142; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1508489; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1508894; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1508905; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509089; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509100; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509230; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509498; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509509; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509733; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1509744; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1510010; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1510078; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1510332; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1511171; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1511429; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1511623; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1511941; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1512385; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1512607; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1512739; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1512886; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1512993; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1513301; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1513913; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1513999; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1514010; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1514491; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1514827; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1515057; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1515284; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1515337; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1515736; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1516027; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1516212; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1517828; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1518500; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1518876; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1519095; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1519341; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1519705; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1519885; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1520017; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1520234; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1520431; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1520780; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1521313; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1522055; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1522585; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1522965; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1523385; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1523410; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1524084; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1524110; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1524844; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1524855; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525021; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525099; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525129; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525236; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525370; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1525381; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1526084; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1526383; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1526732; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1527346; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1527589; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1527861; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1528229; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1528994; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1529279; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1530177; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1530562; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1530902; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1531724; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1532024; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1532505; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1533644; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1533838; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1534204; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1534949; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1534995; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1535316; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1535813; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1536331; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1536661; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1536876; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1536987; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537131; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537142; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537178; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537224; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537235; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537315; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537374; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537385; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537411; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537596; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537624; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537930; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1537938; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538083; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538091; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538150; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538166; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538207; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538570; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1538642; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1539418; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1539487; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1539681; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1539836; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540064; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540120; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540367; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540378; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540706; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540717; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540770; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540781; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540831; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1540842; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 1885950; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2112292; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2112308; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2209044; code bytes = 8030 Found XOR loop in file "_imagingft.cp311-win_amd64.pyd" at offset 2209052; code bytes = 8030 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 405216; code bytes = 30d0 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 405224; code bytes = 30d0 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 34273; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 34280; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 135073; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 135078; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 141735; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 141765; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 149033; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 149043; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 186981; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 187674; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 187682; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 188478; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 188621; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 189849; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 189859; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 192913; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 193001; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 193033; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 232901; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 270357; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 270379; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 343165; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 352493; code bytes = 33c1 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 343792; code bytes = 8030 Found XOR loop in file "_webp.cp311-win_amd64.pyd" at offset 353120; code bytes = 8030 Found XOR loop in file "_imagingcms.cp311-win_amd64.pyd" at offset 163104; code bytes = 8030 Found XOR loop in file "_imagingcms.cp311-win_amd64.pyd" at offset 211705; code bytes = 8030 Found XOR loop in file "_imagingcms.cp311-win_amd64.pyd" at offset 214529; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 131320; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 194795; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 247953; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 250826; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 251073; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 8408; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 170641; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 173513; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 173760; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2666; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3217; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 7874; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15830; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15881; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15937; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55947; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55956; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56166; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56627; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56634; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57097; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57284; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57651; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57821; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58032; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58183; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58340; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58570; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58708; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58942; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 77336; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90889; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91252; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91511; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91814; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54398; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 151697; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 154569; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 154816; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 28408; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 120977; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 123849; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 124096; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 21224; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 116881; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 119754; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 120001; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 39624; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 76945; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 79817; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 80064; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 7144; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 71825; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 74698; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 74945; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 13912; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 57489; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 60362; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 60609; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 3976; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 57489; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 60361; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 60608; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 45065; code bytes = 30d0 Found XOR loop in file "_overlapped.pyd" at offset 4296; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 43665; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 46538; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 46785; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 2648; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 26769; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 29641; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 29888; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 2776; code bytes = 33c1 Found XOR loop in file "_queue.pyd" at offset 12288; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 24209; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 27081; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 27328; code bytes = 80303b:T1c07,"TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000000000000f87f0000602b64f1c6010000b0c05e720600000000e30836f87f00000000000000000000d0a80336f87f00000100000000000000d0a80336f87f0000ac6bce35f87f000020e66bf1c60100000100000000000000bc19e735f87f0000b2b3c835f87f00000000000006910000a2c5c835f87f0000010000000000e0c1b919e735f87f0000000000000000000098c15e72060000000800000000000000ffffffffffffffff0000000000000000ffffffffffffffff8f19e735f87f0000b4bec835f87f00000800000000000000e8e21a36f87f000020c15e72060000001bb7c835f87f000008000000000000000000000000000000506b64f1 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000000000000000000000003664f87f0000b8a75e7206000000b3058467f87f000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0ef8367f87f00000000000000000000b8a75e7206000000000000000000000000000000000400bc010000000000000062262c65f87f00000100000000000000ffb6ed3ef87f0000b06620f2c601000077988467f87f000000000000eb271c0000000000000400bc0100000000000000f1b7ed3ef87f000007000000000000000003fe7f0000000000000000000000002f1c3664f87f00000003fe7f00000000c4b1ed3ef87f00000003fe7f (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000004a1cf2c601000010198867f87f0000000000000000000000008866f87f00000000000000000000ee265965f87f00000700000000000000f0a25e7206000000f0a25e7206000000400e6765f87f000000008866f87f00007b632965f87f0000020000000000000000000000000000009200000000000000a004f866f87f0000e0a25e7206000000bb5f5965f87f00000d000000f87f0000a004f866f87f000092000000000000000000000000000000a004f866f87f00001c5b5965f87f0000000000000000000092000000000000000d000000f87f00000d00000000000000aa00000000000000d2459966f87f0000a03a9e66 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000007026e1f1c60100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031081bc79cad00000000000000000000000000000000000009000000000000006003d23ef87f0000f1348667f87f000000000000000000000000000000000000b05320f2c6010000a08d67efc60100000000000000000000c9028667f87f000001c0403ff87f000040ba5e7206000000b05320f2c60100000000000000000000010000000000000078b95e720600000000000000 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000000000000f87f000020df377306000000000000000000000000e30836f87f00000000000000000000d0a80336f87f00000100000000000000d0a80336f87f0000ac6bce35f87f00008011abf3c60100000100000000000000bc19e735f87f0000b2b3c835f87f00000000000000000000a2c5c835f87f000001000000c6010000b919e735f87f00000000000000000000c8e03773060000000800000000000000ffffffffffffffff0000000000000000ffffffffffffffff8f19e735f87f0000b4bec835f87f00000800000000000000e8e21a36f87f000050e03773060000001bb7c835f87f000008000000000000000000000000000000b00a63f5 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007892)3c:T10fd,"TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" at 00000000-00008488-00000C17-903739372 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" at 00000000-00008488-00000C17-904571015 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" at 00000000-00008488-00000C17-904602723 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" at 00000000-00008488-00000C17-904829392 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" at 00000000-00008488-00000C17-904833542 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905135924 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905149146 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905152602 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905153298 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905163270 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905163962 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905174269 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905175065 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905177530 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905178217 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905180629 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905181302 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905183847 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905184548 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905187922 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905188620 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905191568 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-905192245 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" at 00000000-00008488-00000C17-905194851 "TiMini-Print-GUI-Windows-x86_64.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" at 00000000-00008488-00000C17-9051956273d:T5a8,"TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "TiMini-Print-GUI-Windows-x86_64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")3e:Te78,"TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\PIL (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\encoding (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\http1.0 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\msgs (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\opt0.4 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Africa (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\America (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\America\Argentina (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\America\Indiana (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\America\Kentucky (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\America\North_Dakota (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Antarctica (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Arctic (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Asia (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Atlantic (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Australia (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Brazil (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Canada (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Chile (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Etc (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Europe (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000021282\_tcl_data\tzdata\Indian (UID: 00000000-00008488)3f:T14ae,"TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\ucrtbase.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\python311.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\python3 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter python3 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\DLLs\python3 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_ctypes.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_bz2.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_lzma.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_socket.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\select.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_ssl.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_asyncio.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_overlapped.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_queue.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_tkinter.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_hashlib.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\_uuid.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\PIL\_imaging.cp311-win_amd64.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\PIL\_imagingft.cp311-win_amd64.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter fribidi (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter fribidi-0 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter libfribidi-0 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter bluetoothapis.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\winsdk\_winrt.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter ole32 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\unicodedata.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000021282\winrt\_winrt.cp311-win_amd64.pyd (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00006920)40:T6ce4,"TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008488) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_Clear (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_InitIsolatedConfig (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_Read (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_SetBytesString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_SetString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyConfig_SetWideStringList (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_InitializeFromConfig (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter Py_ExitStatusException (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__asyncio (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__overlapped (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__tkinter (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CancelSynchronousIo (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__imaging (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__imagingft (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindFirstRadio (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindNextRadio (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindRadioClose (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindFirstDevice (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindNextDevice (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter BluetoothFindDeviceClose (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winrt (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Adc (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Adc_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Foundation (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Foundation_Collections (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Gpio (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Gpio_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_I2c (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_I2c_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Pwm (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Pwm_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Spi (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Spi_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Bluetooth (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Bluetooth_GenericAttributeProfile (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Enumeration (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Activation (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Appointments (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_System (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_FileProperties (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Geolocation (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_Streams (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_Search (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Data_Text (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Text (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Text_Core (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Globalization (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_ViewManagement (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Core (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Input (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Haptics (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Input (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Popups (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_WindowManagement (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_System_Diagnostics (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Data_Json (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_System_RemoteSystems (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_AppService (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Networking (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Networking_Connectivity (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Credentials (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Cryptography (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Cryptography_Core (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Cryptography_Certificates (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Appointments_AppointmentsProvider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Background (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Calls (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Contacts (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Calls_Background (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Bluetooth_Advertisement (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Bluetooth_Background (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Bluetooth_Rfcomm (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Networking_Sockets (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Web (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Sensors (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics_Display (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_SmartCards (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Sms (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_UI_Notifications (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Data_Xml_Dom (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Contacts_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_DataTransfer (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_EnterpriseData (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_DataTransfer_ShareTarget (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Search (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_UserDataAccounts (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Email (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_UserDataTasks (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_UserDataAccounts_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Wallet (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Printers (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics_Printing (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Printers_Extensions (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Media (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics_DirectX (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics_DirectX_Direct3D11 (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Graphics_Imaging (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Media_SpeechRecognition (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Authentication_Web (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Authentication_Web_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Security_Authentication_Web_Core (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Web_Http (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Web_Http_Filters (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Web_Http_Headers (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_Pickers (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Storage_Pickers_Provider (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_ApplicationModel_Core (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter PyInit__winsdk_Windows_Devices_Radios (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoIncrementMTAUsage (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006920) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007892) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007892) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007892) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007892) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007892) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007892)41:T77e,"VCRUNTIME140_1.dll" contains export function called "__CxxFrameHandler4" at ordinal 1 "VCRUNTIME140_1.dll" contains export function called "__NLG_Dispatch2" at ordinal 2 "VCRUNTIME140_1.dll" contains export function called "__NLG_Return2" at ordinal 3 "_imaging.cp311-win_amd64.pyd" contains export function called "PyInit__imaging" at ordinal 1 "_imagingft.cp311-win_amd64.pyd" contains export function called "PyInit__imagingft" at ordinal 1 "_webp.cp311-win_amd64.pyd" contains export function called "PyInit__webp" at ordinal 1 "_imagingcms.cp311-win_amd64.pyd" contains export function called "PyInit__imagingcms" at ordinal 1 "_decimal.pyd" contains export function called "PyInit__decimal" at ordinal 1 "_ssl.pyd" contains export function called "OPENSSL_Applink" at ordinal 1 "_ssl.pyd" contains export function called "PyInit__ssl" at ordinal 2 "_lzma.pyd" contains export function called "PyInit__lzma" at ordinal 1 "_elementtree.pyd" contains export function called "PyInit__elementtree" at ordinal 1 "_ctypes.pyd" contains export function called "DllCanUnloadNow" at ordinal 1 "_ctypes.pyd" contains export function called "DllGetClassObject" at ordinal 2 "_ctypes.pyd" contains export function called "PyInit__ctypes" at ordinal 3 "_bz2.pyd" contains export function called "PyInit__bz2" at ordinal 1 "_socket.pyd" contains export function called "PyInit__socket" at ordinal 1 "_hashlib.pyd" contains export function called "PyInit__hashlib" at ordinal 1 "_asyncio.pyd" contains export function called "PyInit__asyncio" at ordinal 1 "_overlapped.pyd" contains export function called "PyInit__overlapped" at ordinal 1 "_multiprocessing.pyd" contains export function called "PyInit__multiprocessing" at ordinal 1 "_queue.pyd" contains export function called "PyInit__queue" at ordinal 1 "_imagingtk.cp311-win_amd64.pyd" contains export function called "PyInit__imagingtk" at ordinal 142:T617,Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8488:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8488:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "Local\SM0:8488:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "SM0:8488:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6920:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6920:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6920:120:WilError_03" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "Local\SM0:6920:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "SM0:6920:120:WilError_03" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "SM0:6920:304:WilStaging_02" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "Local\SM0:6920:120:WilError_03" Process TiMini-Print-GUI-Windows-x86_64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7892:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:7892:304:WilStaging_02"43:Ta7d,Antivirus vendors marked dropped file "VCRUNTIME140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_avif.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_imaging.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_imagingft.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_webp.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_imagingcms.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_elementtree.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ctypes.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_bz2.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_socket.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_hashlib.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_asyncio.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_overlapped.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_multiprocessing.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_queue.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_imagingtk.cp311-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")44:Tbe1,"TiMini-Print-GUI-Windows-x86_64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "_imaging.cp311-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_imagingft.cp311-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_webp.cp311-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_imagingcms.cp311-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_overlapped.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_multiprocessing.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_queue.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_imagingtk.cp311-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT45:T204a,"Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00006920.00000000.168210.36030000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00006920.00000000.168210.36030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000000.168210.F2FD0000.00000004.mdmp ";Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000000.168210.F30D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000000.168210.F39D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000000.168210.F39D0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00006920.00000001.170129.36030000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00006920.00000001.170129.36030000.00000004.mdmp "145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00006920.00000001.170129.F1C90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000001.170129.F344E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000001.170129.F344E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000001.170129.F344E000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000001.170129.F374E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000001.170129.F39D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000001.170129.F39D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000001.170129.F5590000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034B-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000034B-0000-0000" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034B-0000" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "\Software\Class" in Source: 00000000-00006920.00000001.170129.F5B2B000.00000004.mdmp "SOFTWARE\Python\PythonCore\z" in Source: 00000000-00006920.00000002.172052.35E6F000.00000002.mdmp "145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00006920.00000002.172052.F1C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000002.172052.F2FD0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000002.172052.F344E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000002.172052.F344E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000002.172052.F344E000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\Cur" in Source: 00000000-00006920.00000002.172052.F3703000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000002.172052.F374E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000002.172052.F39D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000002.172052.F39D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000002.172052.F5490000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000002.172052.F5590000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034B-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000034B-0000-0000" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034B-0000" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "\Software\Class" in Source: 00000000-00006920.00000002.172052.F5B2B000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00006920.00000003.178514.36030000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00006920.00000003.178514.36030000.00000004.mdmp "145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006920.00000003.178514.F22AB000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000034B-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000003.178514.F23E3000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00006920.00000003.178514.F23E3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006920.00000003.178514.F2FD0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000003.178514.F344E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000003.178514.F346C000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000003.178514.F346C000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\Cur" in Source: 00000000-00006920.00000003.178514.F3702000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000003.178514.F3760000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006920.00000003.178514.F39D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006920.00000003.178514.F5490000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006920.00000003.178514.F5B2B000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034B-0000-0000-C000-000000000046}" in Source: 00000000-00006920.00000003.178514.F5B2B000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006920.00000003.178514.F5B2B000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000034B-0000-0000" in Source: 00000000-00006920.00000003.178514.F5B2B000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00008488.00000000.167195.947E3000.00000004.mdmp46:T66d,"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1 Accept-Encoding: identity Host: api.github.com User-Agent: TiMini-Print/0.9.1 Connection: close" Response ==> HTTP/1.1 200 OK Date: Wed 11 Nov 2026 22:23:30 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"36baed0cf04658cb11b562818d85f38a54f7297eb1cb438c3394f217a49eeea7" Last-Modified: Thu 29 Oct 2026 21:24:43 GMT X-GitHub-Media-Type: github.v3; format=json x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Warning Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 58 X-RateLimit-Used: 2 X-RateLimit-Resource: core X-RateLimit-Reset: 1794436352 Transfer-Encoding: chunked X-GitHub-Request-Id: EE0F:23A346:165325D:463D891:6AF4EAE2 x-github-edge-region: iad connection: close with response body ==>7B2275726C223A2268747470733A2F2F6170692E6769746875622E636F6D2F7265706F732F44656A6E69656C2F54694D696E692D5072696E742F72656C656173.......47:T16a8,"TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff83f350000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff865250000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff865250000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "RPCRT4.DLL" at base 7ff867610000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "VCRUNTIME140.DLL" at base 7ff85a170000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ff858fb0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "NTDLL.DLL" at base 7ff867830000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff862840000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff865250000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff865250000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\UCRTBASE.DLL" at base 7ff847a80000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\PYTHON311.DLL" at base 7ff835c10000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff864ec0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_CTYPES.PYD" at base 7ff850820000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "KERNEL32" at base 7ff865b50000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_BZ2.PYD" at base 7ff850800000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_LZMA.PYD" at base 7ff8507d0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_SOCKET.PYD" at base 7ff84c9c0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\SELECT.PYD" at base 7ff850150000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_SSL.PYD" at base 7ff84c990000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_ASYNCIO.PYD" at base 7ff84c720000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_OVERLAPPED.PYD" at base 7ff850060000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff864570000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_QUEUE.PYD" at base 7ff84f9c0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_TKINTER.PYD" at base 7ff84c700000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "KERNEL32.DLL" at base 7ff865b50000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_HASHLIB.PYD" at base 7ff84af60000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\_UUID.PYD" at base 7ff84ec20000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\PIL\_IMAGING.CP311-WIN_AMD64.PYD" at base 7ff83e2b0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\PIL\_IMAGINGFT.CP311-WIN_AMD64.PYD" at base 7ff83d9a0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "UXTHEME.DLL" at base 7ff862840000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff862d50000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff8666a0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff8666a0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff865f40000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 1c6f14c0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff8659a0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "BLUETOOTHAPIS.DLL" at base 7ff85aa60000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\WINSDK\_WINRT.PYD" at base 7ff833750000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "OLE32" at base 1c6f14c0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "SHELL32" at base 7ff866880000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\UNICODEDATA.PYD" at base 7ff83d880000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff85b7b0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff85c370000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "COMBASE.DLL" at base 7ff865f40000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff8612c0000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.DEVICES.BLUETOOTH.DLL" at base 7ff83f040000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.DEVICES.ENUMERATION.DLL" at base 7ff852420000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff85f020000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\STRUCTUREDQUERY.DLL" at base 7ff858870000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\MSWB7.DLL" at base 7ff852130000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff865f40000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "%TEMP%\_MEI000021282\WINRT\_WINRT.CP311-WIN_AMD64.PYD" at base 7ff83e980000 "TiMini-Print-GUI-Windows-x86_64.exe" loaded module "USER32" at base 7ff8666a0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff83f35000048:Tc02,"TiMini-Print-GUI-Windows-x86_64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TiMini-Print-GUI-Windows-x86_64.exe" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "_imaging.cp311-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_imaging.cp311-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_imagingft.cp311-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_imagingft.cp311-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_webp.cp311-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_webp.cp311-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_imagingcms.cp311-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_imagingcms.cp311-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "_elementtree.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_elementtree.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Linker" and name: "Linker" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Linker" and name: "Linker" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Linker" and name: "Linker" "_asyncio.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_asyncio.pyd" was detected as "Microsoft Linker" and name: "Linker" "_overlapped.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_overlapped.pyd" was detected as "Microsoft Linker" and name: "Linker" "_multiprocessing.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_multiprocessing.pyd" was detected as "Microsoft Linker" and name: "Linker" "_queue.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_queue.pyd" was detected as "Microsoft Linker" and name: "Linker" "_imagingtk.cp311-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_imagingtk.cp311-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker"49:T5b4,"TiMini-Print-GUI-Windows-x86_64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_imaging.cp311-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_imagingft.cp311-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_webp.cp311-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_imagingcms.cp311-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ssl.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_elementtree.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_bz2.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_socket.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_hashlib.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_asyncio.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_overlapped.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_multiprocessing.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_queue.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_imagingtk.cp311-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"4a:T497,"TiMini-Print-GUI-Windows-x86_64.exe" has an executable section named ".text" "VCRUNTIME140_1.dll" has an executable section named ".text" "_imaging.cp311-win_amd64.pyd" has an executable section named ".text" "_imagingft.cp311-win_amd64.pyd" has an executable section named ".text" "_webp.cp311-win_amd64.pyd" has an executable section named ".text" "_imagingcms.cp311-win_amd64.pyd" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "_ssl.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "_elementtree.pyd" has an executable section named ".text" "_ctypes.pyd" has an executable section named ".text" "_bz2.pyd" has an executable section named ".text" "_socket.pyd" has an executable section named ".text" "_hashlib.pyd" has an executable section named ".text" "_asyncio.pyd" has an executable section named ".text" "_overlapped.pyd" has an executable section named ".text" "_multiprocessing.pyd" has an executable section named ".text" "_queue.pyd" has an executable section named ".text" "_imagingtk.cp311-win_amd64.pyd" has an executable section named ".text"4b:T4c1,"TiMini-Print-GUI-Windows-x86_64.exe" has an writable section named ".data" "TiMini-Print-GUI-Windows-x86_64.exe" has an writable section named ".fptable" "VCRUNTIME140_1.dll" has an writable section named ".data" "_imaging.cp311-win_amd64.pyd" has an writable section named ".data" "_imagingft.cp311-win_amd64.pyd" has an writable section named ".data" "_webp.cp311-win_amd64.pyd" has an writable section named ".data" "_imagingcms.cp311-win_amd64.pyd" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "_ssl.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "_elementtree.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data" "_bz2.pyd" has an writable section named ".data" "_socket.pyd" has an writable section named ".data" "_hashlib.pyd" has an writable section named ".data" "_asyncio.pyd" has an writable section named ".data" "_overlapped.pyd" has an writable section named ".data" "_multiprocessing.pyd" has an writable section named ".data" "_queue.pyd" has an writable section named ".data" "_imagingtk.cp311-win_amd64.pyd" has an writable section named ".data"4c:T2843,"TiMini-Print-GUI-Windows-x86_64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000ea00,add rsp, 0x28,jmp 0x14000e5f0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000f000,test eax, eax,je 0x14000e7c9,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d60b], rcx,je 0x14000e7c9,cmp rcx, rax,je 0x14000e7d0,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d5f9], rcx,jne 0x14000e7b7,xor al, al,add rsp, 0x28,ret ,mov al, 1," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004231,call 0x18000456c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800041a0,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,lea rax, [rip + 0x1fe3],mov rbx, rcx,mov qword ptr [rcx], rax,test dl, 1,je 0x180004272,mov edx, 0x18,call 0x18000427c," "_imaging.cp311-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180165a41,call 0x180165f70,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1801658e0,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x180165a80,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ," "_imagingft.cp311-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18015d6a1,call 0x18015df90,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18015d540,int3 ,int3 ,int3 ,mov ecx, 2,int 0x29,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x18015d6f0," "_webp.cp311-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18004f291,call 0x18004f7d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18004f130,int3 ,int3 ,int3 ,mov ecx, 2,int 0x29,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x18004f2e0," "_imagingcms.cp311-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18002f8b1,call 0x18002f8d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18002f750,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x30,mov rax, qword ptr [rip + 0xe723],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,je 0x18002f8fc,not rax," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180020c69,call 0x180020c88,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180020b14,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x16364],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180020d1f," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002c49,call 0x180002c68,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002af4,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1d384],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180002cff," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001380d,call 0x1800139a8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800136b8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x4823],mov rcx, rbx,call qword ptr [rip + 0x4822],call qword ptr [rip + 0x480c],mov rcx, rax," "_elementtree.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800078ed,call 0x180007a88,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180007798,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc70b],mov rcx, rbx,call qword ptr [rip + 0xc6fa],call qword ptr [rip + 0xc73c],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180005cdd,call 0x180005e78,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180005b88,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xa34b],mov rcx, rbx,call qword ptr [rip + 0xa33a],call qword ptr [rip + 0xa344],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a639,call 0x18000a658,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a4e4,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x6994],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a6ef," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800025dd,call 0x180002778,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002488,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x5a43],mov rcx, rbx,call qword ptr [rip + 0x5a32],call qword ptr [rip + 0x5a3c],mov rcx, rax," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000404d,call 0x1800041e8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180003ef8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2fbb],mov rcx, rbx,call qword ptr [rip + 0x2faa],call qword ptr [rip + 0x2fb4],mov rcx, rax," "_asyncio.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000197d,call 0x180001b18,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001828,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x56a3],mov rcx, rbx,call qword ptr [rip + 0x56a2],call qword ptr [rip + 0x568c],mov rcx, rax," "_overlapped.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001abd,call 0x180001c58,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001968,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x455b],mov rcx, rbx,call qword ptr [rip + 0x454a],call qword ptr [rip + 0x4554],mov rcx, rax," "_multiprocessing.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000144d,call 0x1800015e8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800012f8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1beb],mov rcx, rbx,call qword ptr [rip + 0x1b92],call qword ptr [rip + 0x1bf4],mov rcx, rax," "_queue.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800014cd,call 0x180001668,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001378,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1b5b],mov rcx, rbx,call qword ptr [rip + 0x1b5a],call qword ptr [rip + 0x1b44],mov rcx, rax," "_imagingtk.cp311-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001af1,call 0x180001b20,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001990,int3 ,int3 ,int3 ,mov ecx, 2,int 0x29,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x30,mov rax, qword ptr [rip + 0x34d3],"4d:T425,"TiMini-Print-GUI-Windows-x86_64.exe" has high imagebase "0x140000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "_imaging.cp311-win_amd64.pyd" has high imagebase "0x180000000" "_imagingft.cp311-win_amd64.pyd" has high imagebase "0x180000000" "_webp.cp311-win_amd64.pyd" has high imagebase "0x180000000" "_imagingcms.cp311-win_amd64.pyd" has high imagebase "0x180000000" "_decimal.pyd" has high imagebase "0x180000000" "_ssl.pyd" has high imagebase "0x180000000" "_lzma.pyd" has high imagebase "0x180000000" "_elementtree.pyd" has high imagebase "0x180000000" "_ctypes.pyd" has high imagebase "0x180000000" "_bz2.pyd" has high imagebase "0x180000000" "_socket.pyd" has high imagebase "0x180000000" "_hashlib.pyd" has high imagebase "0x180000000" "_asyncio.pyd" has high imagebase "0x180000000" "_overlapped.pyd" has high imagebase "0x180000000" "_multiprocessing.pyd" has high imagebase "0x180000000" "_queue.pyd" has high imagebase "0x180000000" "_imagingtk.cp311-win_amd64.pyd" has high imagebase "0x180000000"4e:T64d1,"VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006920] "_avif.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_avif.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imaging.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imaging.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_imagingft.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingft.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_webp.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_webp.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imagingcms.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingcms.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_decimal.pyd]- [targetUID: 00000000-00006920] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ssl.pyd]- [targetUID: 00000000-00006920] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_lzma.pyd]- [targetUID: 00000000-00006920] "cp936.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp936.enc]- [targetUID: 00000000-00008488] "clock.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\clock.tcl]- [targetUID: 00000000-00008488] "cp949.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp949.enc]- [targetUID: 00000000-00008488] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_elementtree.pyd]- [targetUID: 00000000-00006920] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ctypes.pyd]- [targetUID: 00000000-00006920] "cns11643.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cns11643.enc]- [targetUID: 00000000-00008488] "euc-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\euc-kr.enc]- [targetUID: 00000000-00008488] "ksc5601.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\ksc5601.enc]- [targetUID: 00000000-00008488] "big5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\big5.enc]- [targetUID: 00000000-00008488] "cp950.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp950.enc]- [targetUID: 00000000-00008488] "gb12345.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\gb12345.enc]- [targetUID: 00000000-00008488] "gb2312.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\gb2312.enc]- [targetUID: 00000000-00008488] "gb2312-raw.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\gb2312-raw.enc]- [targetUID: 00000000-00008488] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_bz2.pyd]- [targetUID: 00000000-00006920] "euc-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\euc-jp.enc]- [targetUID: 00000000-00008488] "jis0208.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\jis0208.enc]- [targetUID: 00000000-00008488] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_socket.pyd]- [targetUID: 00000000-00006920] "jis0212.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\jis0212.enc]- [targetUID: 00000000-00008488] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_hashlib.pyd]- [targetUID: 00000000-00006920] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_asyncio.pyd]- [targetUID: 00000000-00006920] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_overlapped.pyd]- [targetUID: 00000000-00006920] "cp932.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp932.enc]- [targetUID: 00000000-00008488] "macJapan.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macJapan.enc]- [targetUID: 00000000-00008488] "shiftjis.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\shiftjis.enc]- [targetUID: 00000000-00008488] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_multiprocessing.pyd]- [targetUID: 00000000-00006920] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_queue.pyd]- [targetUID: 00000000-00006920] "init.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\init.tcl]- [targetUID: 00000000-00006920] "auto.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\auto.tcl]- [targetUID: 00000000-00006920] "_imagingtk.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingtk.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "http.tcl" has type "Unknown"- [targetUID: 00000000-00008488] "history.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\history.tcl]- [targetUID: 00000000-00008488] "bn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\bn.msg]- [targetUID: 00000000-00008488] "el.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\el.msg]- [targetUID: 00000000-00008488] "mk.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\mk.msg]- [targetUID: 00000000-00008488] "be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\be.msg]- [targetUID: 00000000-00008488] "ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ar.msg]- [targetUID: 00000000-00008488] "fa_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fa_in.msg]- [targetUID: 00000000-00008488] "kok.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kok.msg]- [targetUID: 00000000-00008488] "he.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\he.msg]- [targetUID: 00000000-00008488] "bg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\bg.msg]- [targetUID: 00000000-00008488] "ar_sy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ar_sy.msg]- [targetUID: 00000000-00008488] "ar_jo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ar_jo.msg]- [targetUID: 00000000-00008488] "ar_lb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ar_lb.msg]- [targetUID: 00000000-00008488] "mr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\mr.msg]- [targetUID: 00000000-00008488] "hi.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\hi.msg]- [targetUID: 00000000-00008488] "fa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fa.msg]- [targetUID: 00000000-00008488] "ja.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ja.msg]- [targetUID: 00000000-00008488] "ko.msg" has type "Unknown"- [targetUID: 00000000-00008488] "hu.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\hu.msg]- [targetUID: 00000000-00008488] "cs.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\cs.msg]- [targetUID: 00000000-00008488] "lt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\lt.msg]- [targetUID: 00000000-00008488] "is.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\is.msg]- [targetUID: 00000000-00008488] "it.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\it.msg]- [targetUID: 00000000-00008488] "eo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\eo.msg]- [targetUID: 00000000-00008488] "de.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\de.msg]- [targetUID: 00000000-00008488] "de_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\de_be.msg]- [targetUID: 00000000-00008488] "lv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\lv.msg]- [targetUID: 00000000-00008488] "et.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\et.msg]- [targetUID: 00000000-00008488] "fr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fr.msg]- [targetUID: 00000000-00008488] "es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es.msg]- [targetUID: 00000000-00008488] "da.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\da.msg]- [targetUID: 00000000-00008488] "fi.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fi.msg]- [targetUID: 00000000-00008488] "ga.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ga.msg]- [targetUID: 00000000-00008488] "hr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\hr.msg]- [targetUID: 00000000-00008488] "ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ca.msg]- [targetUID: 00000000-00008488] "macDingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macDingbats.enc]- [targetUID: 00000000-00008488] "macCyrillic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macCyrillic.enc]- [targetUID: 00000000-00008488] "macCentEuro.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macCentEuro.enc]- [targetUID: 00000000-00008488] "macCroatian.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macCroatian.enc]- [targetUID: 00000000-00008488] "iso8859-16.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-16.enc]- [targetUID: 00000000-00008488] "macRomania.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macRomania.enc]- [targetUID: 00000000-00008488] "iso8859-10.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-10.enc]- [targetUID: 00000000-00008488] "iso8859-14.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-14.enc]- [targetUID: 00000000-00008488] "iso8859-13.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-13.enc]- [targetUID: 00000000-00008488] "iso8859-11.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-11.enc]- [targetUID: 00000000-00008488] "macIceland.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macIceland.enc]- [targetUID: 00000000-00008488] "iso8859-15.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-15.enc]- [targetUID: 00000000-00008488] "macTurkish.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macTurkish.enc]- [targetUID: 00000000-00008488] "macUkraine.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macUkraine.enc]- [targetUID: 00000000-00008488] "iso8859-1.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-1.enc]- [targetUID: 00000000-00008488] "iso8859-8.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-8.enc]- [targetUID: 00000000-00008488] "iso8859-7.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-7.enc]- [targetUID: 00000000-00008488] "iso8859-5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-5.enc]- [targetUID: 00000000-00008488] "iso8859-4.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-4.enc]- [targetUID: 00000000-00008488] "iso8859-2.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-2.enc]- [targetUID: 00000000-00008488] "iso8859-9.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-9.enc]- [targetUID: 00000000-00008488] "iso8859-6.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-6.enc]- [targetUID: 00000000-00008488] "iso8859-3.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso8859-3.enc]- [targetUID: 00000000-00008488] "macGreek.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macGreek.enc]- [targetUID: 00000000-00008488] "dingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\dingbats.enc]- [targetUID: 00000000-00008488] "macRoman.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macRoman.enc]- [targetUID: 00000000-00008488] "tis-620.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\tis-620.enc]- [targetUID: 00000000-00008488] "macThai.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\macThai.enc]- [targetUID: 00000000-00008488] "jis0201.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\jis0201.enc]- [targetUID: 00000000-00008488] "cp1255.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1255.enc]- [targetUID: 00000000-00008488] "cp1250.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1250.enc]- [targetUID: 00000000-00008488] "cp1254.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1254.enc]- [targetUID: 00000000-00008488] "gb1988.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\gb1988.enc]- [targetUID: 00000000-00008488] "cp1252.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1252.enc]- [targetUID: 00000000-00006920] "symbol.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\symbol.enc]- [targetUID: 00000000-00008488] "cp1257.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1257.enc]- [targetUID: 00000000-00008488] "koi8-u.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\koi8-u.enc]- [targetUID: 00000000-00008488] "cp1258.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1258.enc]- [targetUID: 00000000-00008488] "cp1251.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1251.enc]- [targetUID: 00000000-00008488] "cp1253.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1253.enc]- [targetUID: 00000000-00008488] "koi8-r.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\koi8-r.enc]- [targetUID: 00000000-00008488] "cp1256.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp1256.enc]- [targetUID: 00000000-00008488] "cp850.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp850.enc]- [targetUID: 00000000-00008488] "cp866.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp866.enc]- [targetUID: 00000000-00008488] "cp860.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp860.enc]- [targetUID: 00000000-00008488] "cp775.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp775.enc]- [targetUID: 00000000-00008488] "cp874.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp874.enc]- [targetUID: 00000000-00008488] "cp863.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp863.enc]- [targetUID: 00000000-00008488] "cp861.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp861.enc]- [targetUID: 00000000-00008488] "cp852.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp852.enc]- [targetUID: 00000000-00008488] "cp737.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp737.enc]- [targetUID: 00000000-00008488] "ascii.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\ascii.enc]- [targetUID: 00000000-00008488] "cp869.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp869.enc]- [targetUID: 00000000-00008488] "cp857.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp857.enc]- [targetUID: 00000000-00008488] "cp862.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp862.enc]- [targetUID: 00000000-00008488] "cp864.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp864.enc]- [targetUID: 00000000-00008488] "cp865.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp865.enc]- [targetUID: 00000000-00008488] "cp855.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp855.enc]- [targetUID: 00000000-00008488] "cp437.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\cp437.enc]- [targetUID: 00000000-00008488] "gv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\gv.msg]- [targetUID: 00000000-00008488] "ebcdic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\ebcdic.enc]- [targetUID: 00000000-00008488] "af.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\af.msg]- [targetUID: 00000000-00008488] "fo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fo.msg]- [targetUID: 00000000-00008488] "eu.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\eu.msg]- [targetUID: 00000000-00008488] "kl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kl.msg]- [targetUID: 00000000-00008488] "kw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kw.msg]- [targetUID: 00000000-00008488] "gl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\gl.msg]- [targetUID: 00000000-00008488] "id.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\id.msg]- [targetUID: 00000000-00008488] "de_at.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\de_at.msg]- [targetUID: 00000000-00008488] "pkgIndex.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\http1.0\pkgIndex.tcl]- [targetUID: 00000000-00006920] "fa_ir.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fa_ir.msg]- [targetUID: 00000000-00008488] "ko_kr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ko_kr.msg]- [targetUID: 00000000-00008488] "en_ph.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_ph.msg]- [targetUID: 00000000-00008488] "en_hk.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_hk.msg]- [targetUID: 00000000-00008488] "en_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_in.msg]- [targetUID: 00000000-00008488] "en_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_be.msg]- [targetUID: 00000000-00008488] "en_nz.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_nz.msg]- [targetUID: 00000000-00008488] "en_au.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_au.msg]- [targetUID: 00000000-00008488] "en_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_ca.msg]- [targetUID: 00000000-00008488] "eu_es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\eu_es.msg]- [targetUID: 00000000-00008488] "fr_ch.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fr_ch.msg]- [targetUID: 00000000-00008488] "fo_fo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fo_fo.msg]- [targetUID: 00000000-00008488] "kl_gl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kl_gl.msg]- [targetUID: 00000000-00008488] "en_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_gb.msg]- [targetUID: 00000000-00008488] "ga_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ga_ie.msg]- [targetUID: 00000000-00008488] "en_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_ie.msg]- [targetUID: 00000000-00008488] "fr_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fr_be.msg]- [targetUID: 00000000-00008488] "fr_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\fr_ca.msg]- [targetUID: 00000000-00008488] "ar_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\ar_in.msg]- [targetUID: 00000000-00008488] "bn_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\bn_in.msg]- [targetUID: 00000000-00008488] "kok_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kok_in.msg]- [targetUID: 00000000-00008488] "es_pe.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_pe.msg]- [targetUID: 00000000-00008488] "gl_es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\gl_es.msg]- [targetUID: 00000000-00008488] "af_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\af_za.msg]- [targetUID: 00000000-00008488] "es_ni.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_ni.msg]- [targetUID: 00000000-00008488] "es_py.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_py.msg]- [targetUID: 00000000-00008488] "en_sg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_sg.msg]- [targetUID: 00000000-00008488] "gv_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\gv_gb.msg]- [targetUID: 00000000-00008488] "en_zw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_zw.msg]- [targetUID: 00000000-00008488] "es_mx.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_mx.msg]- [targetUID: 00000000-00008488] "es_pa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_pa.msg]- [targetUID: 00000000-00008488] "es_uy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_uy.msg]- [targetUID: 00000000-00008488] "es_pr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_pr.msg]- [targetUID: 00000000-00008488] "hi_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\hi_in.msg]- [targetUID: 00000000-00008488] "en_bw.msg" has type "Unknown"- [targetUID: 00000000-00008488] "mr_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\mr_in.msg]- [targetUID: 00000000-00008488] "es_gt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_gt.msg]- [targetUID: 00000000-00008488] "es_bo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_bo.msg]- [targetUID: 00000000-00008488] "es_cr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_cr.msg]- [targetUID: 00000000-00008488] "es_ve.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_ve.msg]- [targetUID: 00000000-00008488] "es_ec.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_ec.msg]- [targetUID: 00000000-00008488] "kw_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\kw_gb.msg]- [targetUID: 00000000-00008488] "es_sv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_sv.msg]- [targetUID: 00000000-00008488] "es_cl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_cl.msg]- [targetUID: 00000000-00008488] "es_hn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_hn.msg]- [targetUID: 00000000-00008488] "es_do.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_do.msg]- [targetUID: 00000000-00008488] "id_id.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\id_id.msg]- [targetUID: 00000000-00008488] "es_co.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_co.msg]- [targetUID: 00000000-00008488] "en_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\en_za.msg]- [targetUID: 00000000-00008488] "it_ch.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\it_ch.msg]- [targetUID: 00000000-00008488] "es_ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\msgs\es_ar.msg]- [targetUID: 00000000-00008488] "iso2022.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso2022.enc]- [targetUID: 00000000-00008488] "iso2022-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso2022-jp.enc]- [targetUID: 00000000-00008488] "iso2022-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\iso2022-kr.enc]- [targetUID: 00000000-00008488] "euc-cn.enc" has type "Unknown"- Location: [%TEMP%\_MEI000021282\_tcl_data\encoding\euc-cn.enc]- [targetUID: 00000000-00008488]4f:T85f,"TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TIMINI-PRINT-GUI-WINDOWS-X86_64.EXE"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "")50:Te8c,"TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "TIMINI-PRINT-GUI-WINDOWS-X86_64"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "")51:T438,"TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\Windows\System32\imm32.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "\Device\KsecDD" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\FLTLIB.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL"52:T51d,"TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\FLTLIB.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\MSVCP140.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\VCRUNTIME140.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\VCRUNTIME140_1.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\FLTLIB.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\x3hq0DA\AppData\Local\Temp\_MEI000021282\FLTLIB.DLL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\MSVCP140.dll" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\x3hq0DA\AppData\Local\Temp\_MEI000021282\MSVCP140.dll"53:Te39,"TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL\_imaging.cp311-win_amd64.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL\_imagingcms.cp311-win_amd64.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL\_imagingft.cp311-win_amd64.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL\_imagingtk.cp311-win_amd64.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\PIL\_webp.cp311-win_amd64.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_asyncio.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_bz2.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_ctypes.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_decimal.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_elementtree.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_hashlib.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_lzma.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_multiprocessing.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_overlapped.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_queue.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_socket.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_ssl.pyd" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\clock.tcl" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding\big5.enc" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding\cns11643.enc" "TiMini-Print-GUI-Windows-x86_64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000021282\_tcl_data\encoding\cp1250.enc"54:Tf93,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "wsastartup"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "http.tcl") file/memory contains long string with (Indicator: " accept "; File: "http.tcl") file/memory contains long string with (Indicator: " send "; File: "http.tcl") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "TiMini-Print-GUI-Windows-x86_64.exe") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp") Found reference to API "Non-blocking SSL socket needs to read more data" (Indicator: " socket "; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found reference to API "Non-blocking SSL socket needs to write more data" (Indicator: " socket "; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F15F0000.00000004.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F15F0000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found reference to API "GETHOSTBYNAME_ADDR_IS_NOT_AF_INET" (Indicator: "gethostbyname"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F2490000.00000004.mdmp")55:Te855,Found URL "https://www.python.org/psf/license/_path_isfile" - Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found URL "http://" - Source: "00000000-00006920.00000000.168210.F1890000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00006920.00000000.168210.F1890000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006920.00000000.168210.F1890000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr108b?" - Source: "00000000-00006920.00000000.168210.F1890000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006920.00000000.168210.F1890000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000000.168210.F1990000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crlgeotrust" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmgeotrust" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-569n" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5396globalsign" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10washington1redmond1microsoft" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmequifax1-0+$equifax" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-5330,;vk7nhr,d" - Source: "00000000-00006920.00000000.168210.F1C90000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/de=0internal" - Source: "00000000-00006920.00000000.168210.F1E90000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crlr;jmus1!0network" - Source: "00000000-00006920.00000000.168210.F2447000.00000004.mdmp") Found URL "https://play.google.com/store/apps/details?id=pl.wtrymiga.timiniprintc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\__init__.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\base_events.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\concurrent\__init__.pyschedule" - Source: "00000000-00006920.00000000.168210.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000000.168210.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000000.168210.F2590000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00006920.00000000.168210.F2590000.00000004.mdmp") Found URL "https://docs.python.org/2/library/hashlib.htmlsome" - Source: "00000000-00006920.00000000.168210.F2690000.00000004.mdmp") Found URL "https://dzone.com/articles/crc8pyand" - Source: "00000000-00006920.00000000.168210.F2690000.00000004.mdmp") Found URL "http://snippets.dzone.com/posts/show/3543resolved" - Source: "00000000-00006920.00000000.168210.F2690000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00006920.00000000.168210.F2BD0000.00000004.mdmp") Found URL "https://github.com/python-pillow/pillow/pillow" - Source: "00000000-00006920.00000000.168210.F2CD0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000000.168210.F2CD0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00006920.00000000.168210.F2DD0000.00000004.mdmp") Found URL "https://github.com/platformdirs/platformdirs>" - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid>" - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://dotcolon.net/fonts/aileron," - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://www.mia.uni-saarland.de/publications/gwosdek-ssvm11.pdf>" - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/nt.pode=0_lucknormalprobestate(protocol_variant:" - Source: "00000000-00006920.00000000.168210.F2ED0000.00000004.mdmp") Found URL "https://github.com/dejniel/timini-print/releases/taginiprintruntimesessionapi.can_send_control_packet_wait_notificationruntimesessionapi.can_observe_control_notificationsruntime" - Source: "00000000-00006920.00000000.168210.F2FD0000.00000004.mdmp") Found URL "https://api.github.com/repos/dejniel/timini-print/releases/latestc:\users\x3hq0da\appdata\local\temp\_mei000021282\timiniprint\update_check.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\urllib\request.pycafile," - Source: "00000000-00006920.00000000.168210.F2FD0000.00000004.mdmp") Found URL "http://r" - Source: "00000000-00006920.00000000.168210.F30D0000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00006920.00000000.168210.F30D0000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00006920.00000000.168210.F30D0000.00000004.mdmp") Found URL "https://www.python.org/')open" - Source: "00000000-00006920.00000000.168210.F30D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpapreserve" - Source: "00000000-00006920.00000000.168210.F3294000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crtigicert" - Source: "00000000-00006920.00000000.168210.F3294000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/esscontenthintdecodeex0/0-!http://ocsp.globalsign.com/rootr11.3.6.1.5.5.7.3.2(c)" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0,0*$http://crl.godaddy.com/gdroot-g2.crl(c)" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlclass" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtepca-g3.crl04020*0(https://www.digicert.com/cps0&0$http://ocsp.digicert.com0*0(" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl1.3.6.1.4.1.311.20.21.3.6.1.5.5.7.1.11.3.6.1.5.5.7.3.3comodo" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crlverisign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://www.digicert.com/cpsm" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://ocsp.usertrust.comdfd" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crldod00&0$http://ocsp.digicert.comdqtth1.2.840.10045.2.1didndddvdhdgdydtd,@t1.3.6.1.5.5.7.1.12ziht2.16.840.1.113730.1.13d^ptmicrosoft" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl:func:" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crltype[pmicrosoft" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr1_set_p" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.comglobalsign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com:3yor41+0)" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl:3yor4addtrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifdigicert" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifid]2u'b=" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmdigicert" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmswisssign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crlhl3%g0e1quovadis" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://ocsp.thawte.com" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl-.>" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerthighassuranceevrootca.crl(0d]u1.3.6.1.4.1.311.10.3.5root" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crlel_i]x" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://www.verisign.com/cpsgeotrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://www.thawte.com/cps" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://certs.godaddy.com/repository/geotrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/verisign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0<0:0200$https://www.alphassl.com/repository/" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.geotrust.com/resources/cpsprovider=default,fips=yes,input=msblob" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.geotrust.com/resources/cps0;093http://crl.usertrust.com/addtrustexternalcaroot.crlthawte," - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://h^?ow" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rom/comodowxy" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vparisroot" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comgeotrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comdigicert" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmglobalsign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl()geotrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crlter_asyncstatu0q0oihttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crldhelglobalsign" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crtperathttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crlyvalueus1)0'" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crtus1)0'" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crlz]i203730\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpaprovider=default,fips=no,input=der,structure=subjectpublickeyinfo0373provider=default,fips=yes,input=der,structure=encryptedprivatekeyinfothawte," - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://g2.symcb.comhucasymantec" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://s2.symcb.comsymantecpki-1-539microsoft" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://g2.symcb.comusertrust" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0@b*4" - Source: "00000000-00006920.00000000.168210.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl(c)" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl1.3.6.1.5.5.7.3.8microsoft" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crlgo" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://repository.swisssign.com/geotrust" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn7www.entrust.net/cps_2048" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://rtcom.or.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl(c)" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0us1" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0c0a0e>ytwila!x<,:w%w0certigna0070629151305z270629151305z041" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmjp1%0" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006920.00000000.168210.F34D6000.00000004.mdmp") Found URL "http://get_user_passwdproxyselectorhttps://" - Source: "00000000-00006920.00000000.168210.F38D0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00006920.00000000.168210.F38D0000.00000004.mdmp") Found URL "https://github.com/tox-dev/platformdirs/issues/501." - Source: "00000000-00006920.00000000.168210.F39D0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/api/shlobj_core/nf-shlobj_core-shgetknownfolderpath." - Source: "00000000-00006920.00000000.168210.F39D0000.00000004.mdmp") Found URL "https://www.python.org/psf/license/_path_isfile" - Source: "00000000-00006920.00000001.170129.36030000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000001.170129.F15F0000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00006920.00000001.170129.F15F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00006920.00000001.170129.F15F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00006920.00000001.170129.F1890000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000001.170129.F1990000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmgeotrust" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-569n@sg" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5396-----------------------winrt" - Source: "00000000-00006920.00000001.170129.F1C90000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/de=0internal" - Source: "00000000-00006920.00000001.170129.F1E90000.00000004.mdmp") Found URL "https://github.com/microsoft/xlang/tree/master/src/package/pywinrt/projection/>" - Source: "00000000-00006920.00000001.170129.F2447000.00000004.mdmp") Found URL "https://play.google.com/store/apps/details?id=pl.wtrymiga.timiniprintc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\__init__.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\base_events.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\concurrent\__init__.pyschedule" - Source: "00000000-00006920.00000001.170129.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000001.170129.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000001.170129.F2590000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00006920.00000001.170129.F2590000.00000004.mdmp") Found URL "https://docs.python.org/2/library/hashlib.htmlsome" - Source: "00000000-00006920.00000001.170129.F2690000.00000004.mdmp") Found URL "https://dzone.com/articles/crc8pyand" - Source: "00000000-00006920.00000001.170129.F2690000.00000004.mdmp") Found URL "http://snippets.dzone.com/posts/show/3543resolved" - Source: "00000000-00006920.00000001.170129.F2690000.00000004.mdmp") Found URL "https://btprodspecificationrefs.blob.core.windows.net/assigned-numbers/assigned%20number%20types/generic%20access%20profile.pdf>" - Source: "00000000-00006920.00000001.170129.F2790000.00000004.mdmp") Found URL "https://github.com/python-pillow/pillow/pillow" - Source: "00000000-00006920.00000001.170129.F2CD0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000001.170129.F2CD0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00006920.00000001.170129.F2DD0000.00000004.mdmp") Found URL "https://github.com/platformdirs/platformdirs>" - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid>" - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://dotcolon.net/fonts/aileron," - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://www.mia.uni-saarland.de/publications/gwosdek-ssvm11.pdf>" - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/nt.pode=0_lucknormalprobestate(protocol_variant:" - Source: "00000000-00006920.00000001.170129.F2ED0000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00006920.00000001.170129.F30D0000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00006920.00000001.170129.F30D0000.00000004.mdmp") Found URL "https://www.python.org/')open" - Source: "00000000-00006920.00000001.170129.F30D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/esscontenthintdecodeex0/0-!http://ocsp.globalsign.com/rootr11.3.6.1.5.5.7.3.2(c)" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0,0*$http://crl.godaddy.com/gdroot-g2.crl(c)" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlclass" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtepca-g3.crl04020*0(https://www.digicert.com/cps0&0$http://ocsp.digicert.com0*0(" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl1.3.6.1.4.1.311.20.21.3.6.1.5.5.7.1.11.3.6.1.5.5.7.3.3comodo" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crlverisign" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "https://www.digicert.com/cpsm" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://ocsp.usertrust.comdfd" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crldod00&0$http://ocsp.digicert.comdqtth1.2.840.10045.2.1didnddd,@t1.3.6.1.5.5.7.1.12\es9ziht2.16.840.1.113730.1.13microsoft" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl:func:" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crltype[pmicrosoft" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr1_set_p" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://ocsp.thawte.com" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vroot" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://g2.symcb.comusertrust" - Source: "00000000-00006920.00000001.170129.F344E000.00000004.mdmp") Found URL "http://get_user_passwdproxyselectorhttps://" - Source: "00000000-00006920.00000001.170129.F38D0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00006920.00000001.170129.F38D0000.00000004.mdmp") Found URL "https://github.com/bluez/bluez/blob/master/doc/org.bluez.adapter.rst" - Source: "00000000-00006920.00000001.170129.F38D0000.00000004.mdmp") Found URL "https://github.com/tox-dev/platformdirs/issues/501." - Source: "00000000-00006920.00000001.170129.F39D0000.00000004.mdmp") Found URL "https://github.com/bluez/bluez/blob/master/doc/org.bluez.advertisementmonitor.rst" - Source: "00000000-00006920.00000001.170129.F39D0000.00000004.mdmp") Found URL "https://btprodspecificationrefs.blob.core.windows.net/assigned-numbers/assigned%20number%20types/generic%20access%20profile.pdf>" - Source: "00000000-00006920.00000001.170129.F39D0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/api/shlobj_core/nf-shlobj_core-shgetknownfolderpath." - Source: "00000000-00006920.00000001.170129.F39D0000.00000004.mdmp") Found URL "https://github.com/bluez/bluez/blob/master/doc/org.bluez.adapter.rst" - Source: "00000000-00006920.00000001.170129.F47A0000.00000004.mdmp") Found URL "https://www.bluetooth.com/specifications/assigned-numbers/>.->cugp" - Source: "00000000-00006920.00000001.170129.F5590000.00000004.mdmp") Found URL "https://peps.python.org/pep-3118/" - Source: "00000000-00006920.00000001.170129.F5590000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00006920.00000002.172052.35E6F000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00006920.00000002.172052.F1890000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000002.172052.F1990000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmgeotrust" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-569n@sg" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5396-----------------------winrt" - Source: "00000000-00006920.00000002.172052.F1C90000.00000004.mdmp") Found URL "https://github.com/microsoft/xlang/tree/master/src/package/pywinrt/projection/>" - Source: "00000000-00006920.00000002.172052.F2447000.00000004.mdmp") Found URL "https://play.google.com/store/apps/details?id=pl.wtrymiga.timiniprintc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\__init__.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\base_events.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\concurrent\__init__.pyschedule" - Source: "00000000-00006920.00000002.172052.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000002.172052.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000002.172052.F2590000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00006920.00000002.172052.F2590000.00000004.mdmp") Found URL "https://docs.python.org/2/library/hashlib.htmlsome" - Source: "00000000-00006920.00000002.172052.F2690000.00000004.mdmp") Found URL "https://dzone.com/articles/crc8pyand" - Source: "00000000-00006920.00000002.172052.F2690000.00000004.mdmp") Found URL "http://snippets.dzone.com/posts/show/3543resolved" - Source: "00000000-00006920.00000002.172052.F2690000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00006920.00000002.172052.F2BD0000.00000004.mdmp") Found URL "https://github.com/dejniel/timini-print/releases/taginiprintruntimesessionapi.can_send_control_packet_wait_notificationruntimesessionapi.can_observe_control_notificationsruntime" - Source: "00000000-00006920.00000002.172052.F2FD0000.00000004.mdmp") Found URL "https://api.github.com/repos/dejniel/timini-print/releases/latestc:\users\x3hq0da\appdata\local\temp\_mei000021282\timiniprint\update_check.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\urllib\request.pycafile," - Source: "00000000-00006920.00000002.172052.F2FD0000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00006920.00000002.172052.F30D0000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00006920.00000002.172052.F30D0000.00000004.mdmp") Found URL "https://www.python.org/')open" - Source: "00000000-00006920.00000002.172052.F30D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/esscontenthintdecodeex0/0-!http://ocsp.globalsign.com/rootr11.3.6.1.5.5.7.3.2(c)" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0,0*$http://crl.godaddy.com/gdroot-g2.crl(c)" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlclass" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtepca-g3.crl04020*0(https://www.digicert.com/cps0&0$http://ocsp.digicert.com0*0(" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl1.3.6.1.4.1.311.20.21.3.6.1.5.5.7.1.11.3.6.1.5.5.7.3.3comodo" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crlverisign" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "https://www.digicert.com/cpsm" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://ocsp.usertrust.comdfd" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crldod00&0$http://ocsp.digicert.comdqtth1.2.840.10045.2.1didnddd,@t1.3.6.1.5.5.7.1.12\es9ziht2.16.840.1.113730.1.13microsoft" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl:func:" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crltype[pmicrosoft" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr1_set_p" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://ocsp.thawte.com" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vroot" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "http://g2.symcb.comusertrust" - Source: "00000000-00006920.00000002.172052.F344E000.00000004.mdmp") Found URL "https://github.com/tox-dev/platformdirs/issues/501." - Source: "00000000-00006920.00000002.172052.F39D0000.00000004.mdmp") Found URL "https://github.com/bluez/bluez/blob/master/doc/org.bluez.advertisementmonitor.rst" - Source: "00000000-00006920.00000002.172052.F39D0000.00000004.mdmp") Found URL "https://btprodspecificationrefs.blob.core.windows.net/assigned-numbers/assigned%20number%20types/generic%20access%20profile.pdf>" - Source: "00000000-00006920.00000002.172052.F39D0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/api/shlobj_core/nf-shlobj_core-shgetknownfolderpath." - Source: "00000000-00006920.00000002.172052.F39D0000.00000004.mdmp") Found URL "https://www.bluetooth.com/specifications/assigned-numbers/>.->cugp" - Source: "00000000-00006920.00000002.172052.F5590000.00000004.mdmp") Found URL "https://peps.python.org/pep-3118/" - Source: "00000000-00006920.00000002.172052.F5590000.00000004.mdmp") Found URL "https://www.python.org/psf/license/_path_isfile" - Source: "00000000-00006920.00000003.178514.36030000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00006920.00000003.178514.39AA2000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00006920.00000003.178514.39BE8000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00006920.00000003.178514.4B101000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00006920.00000003.178514.F18A9000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00006920.00000003.178514.F18A9000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00006920.00000003.178514.F18A9000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00006920.00000003.178514.F18A9000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00006920.00000003.178514.F18A9000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000003.178514.F18B5000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00006920.00000003.178514.F18B5000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00006920.00000003.178514.F18B5000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00006920.00000003.178514.F18B5000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00006920.00000003.178514.F18B5000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00006920.00000003.178514.F194F000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00006920.00000003.178514.F1990000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00006920.00000003.178514.F1CBB000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00006920.00000003.178514.F1D66000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmgeotrust" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-569n@sg" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5396-----------------------winrt" - Source: "00000000-00006920.00000003.178514.F1DDB000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/de=0internal" - Source: "00000000-00006920.00000003.178514.F1E90000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00006920.00000003.178514.F21CA000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00006920.00000003.178514.F21EF000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/typography/opentype/spec/featurelist" - Source: "00000000-00006920.00000003.178514.F21EF000.00000004.mdmp") Found URL "https://www.w3.org/international/articles/language-tags/>" - Source: "00000000-00006920.00000003.178514.F21EF000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/" - Source: "00000000-00006920.00000003.178514.F22AB000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0wan-y," - Source: "00000000-00006920.00000003.178514.F22AB000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/\es9\es9symantec" - Source: "00000000-00006920.00000003.178514.F22AB000.00000004.mdmp") Found URL "http://s2.symcb.com" - Source: "00000000-00006920.00000003.178514.F22AB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006920.00000003.178514.F231B000.00000004.mdmp") Found URL "https://docs.python.org/3/library/inspect.html" - Source: "00000000-00006920.00000003.178514.F231B000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006920.00000003.178514.F2368000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-41500000hori" - Source: "00000000-00006920.00000003.178514.F2368000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/typography/opentype/spec/featurelist" - Source: "00000000-00006920.00000003.178514.F23A3000.00000004.mdmp") Found URL "https://www.w3.org/international/articles/language-tags/>" - Source: "00000000-00006920.00000003.178514.F23A3000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid>" - Source: "00000000-00006920.00000003.178514.F23CC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmithub_rehingvaluertzinfoastimezone)__future__rwork:param" - Source: "00000000-00006920.00000003.178514.F23E3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.comarizona1scottsdale1godaddy.com," - Source: "00000000-00006920.00000003.178514.F23E3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comtimet" - Source: "00000000-00006920.00000003.178514.F23E3000.00000004.mdmp") Found URL "https://github.com/microsoft/xlang/tree/master/src/package/pywinrt/projection/>" - Source: "00000000-00006920.00000003.178514.F23E3000.00000004.mdmp") Found URL "https://github.com/microsoft/xlang/tree/master/src/package/pywinrt/projection/>" - Source: "00000000-00006920.00000003.178514.F2447000.00000004.mdmp") Found URL "https://play.google.com/store/apps/details?id=pl.wtrymiga.timiniprintc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\__init__.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\asyncio\base_events.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\concurrent\__init__.pyschedule" - Source: "00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00006920.00000003.178514.F2590000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00006920.00000003.178514.F2590000.00000004.mdmp") Found URL "https://docs.python.org/2/library/hashlib.htmlsome" - Source: "00000000-00006920.00000003.178514.F2690000.00000004.mdmp") Found URL "https://dzone.com/articles/crc8pyand" - Source: "00000000-00006920.00000003.178514.F2690000.00000004.mdmp") Found URL "http://snippets.dzone.com/posts/show/3543resolved" - Source: "00000000-00006920.00000003.178514.F2690000.00000004.mdmp") Found URL "https://btprodspecificationrefs.blob.core.windows.net/assigned-numbers/assigned%20number%20types/generic%20access%20profile.pdf>" - Source: "00000000-00006920.00000003.178514.F2790000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00006920.00000003.178514.F2BD0000.00000004.mdmp") Found URL "https://github.com/python-pillow/pillow/pillow" - Source: "00000000-00006920.00000003.178514.F2CD0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000003.178514.F2CD0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00006920.00000003.178514.F2DD0000.00000004.mdmp") Found URL "https://github.com/platformdirs/platformdirs>" - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid>" - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://dotcolon.net/fonts/aileron," - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://www.mia.uni-saarland.de/publications/gwosdek-ssvm11.pdf>" - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/unsharp_masking" - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/nt.pode=0_lucknormalprobestate(protocol_variant:" - Source: "00000000-00006920.00000003.178514.F2ED0000.00000004.mdmp") Found URL "https://github.com/dejniel/timini-print/releases/taginiprintruntimesessionapi.can_send_control_packet_wait_notificationruntimesessionapi.can_observe_control_notificationsruntime" - Source: "00000000-00006920.00000003.178514.F2FD0000.00000004.mdmp") Found URL "https://api.github.com/repos/dejniel/timini-print/releases/latestc:\users\x3hq0da\appdata\local\temp\_mei000021282\timiniprint\update_check.pyc:\users\x3hq0da\appdata\local\temp\_mei000021282\urllib\request.pycafile," - Source: "00000000-00006920.00000003.178514.F2FD0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/esscontenthintdecodeex0/0-!http://ocsp.globalsign.com/rootr11.3.6.1.5.5.7.3.2(c)" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0,0*$http://crl.godaddy.com/gdroot-g2.crl(c)" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlclass" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtepca-g3.crl04020*0(https://www.digicert.com/cps0&0$http://ocsp.digicert.com0*0(" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl1.3.6.1.4.1.311.20.21.3.6.1.5.5.7.1.11.3.6.1.5.5.7.3.3comodo" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crlverisign" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "https://www.digicert.com/cpsm" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://ocsp.usertrust.comdfd" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crldod00&0$http://ocsp.digicert.comdqtth1.2.840.10045.2.1didnddd,@t1.3.6.1.5.5.7.1.12\es9ziht2.16.840.1.113730.1.13microsoft" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl:func:" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crltype[pmicrosoft" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr1_set_p" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://ocsp.thawte.com" - Source: "00000000-00006920.00000003.178514.F344E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vroot" - Source: "00000000-00006920.00000003.178514.F346C000.00000004.mdmp") Found URL "http://g2.symcb.comusertrust" - Source: "00000000-00006920.00000003.178514.F346C000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl(c)" - Source: "00000000-00006920.00000003.178514.F34D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl1.3.6.1.5.5.7.3.8microsoft" - Source: "00000000-00006920.00000003.178514.F34D5000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crlgo" - Source: "00000000-00006920.00000003.178514.F34D5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," - Source: "00000000-00006920.00000003.178514.F39D0000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/api/shlobj_core/nf-shlobj_core-shgetknownfolderpath." - Source: "00000000-00006920.00000003.178514.F39D0000.00000004.mdmp") Found URL "https://github.com/bluez/bluez/blob/master/doc/org.bluez.adapter.rst" - Source: "00000000-00006920.00000003.178514.F47A0000.00000004.mdmp") Found URL "https://www.bluetooth.com/specifications/assigned-numbers/>.->cugp" - Source: "00000000-00006920.00000003.178514.F5590000.00000004.mdmp") Found URL "https://peps.python.org/pep-3118/" - Source: "00000000-00006920.00000003.178514.F5590000.00000004.mdmp")56:Td5f,"TiMini-Print-GUI-Windows-x86_64.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI000021282\*.* (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-1.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-kernel32-legacy-l1-1-1.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00006920) "TiMini-Print-GUI-Windows-x86_64.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00006920)57:T1354,Found string "path_name -- filesystem location of a Python script, zipfile," (Indicator: "zipfile"; Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000000.168210.F15F0000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.F15F0000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000000.168210.F15F0000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.F15F0000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.F15F0000.00000004.mdmp") Found string "NIGIDAESH" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "NGGUAESHA" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "MAESI" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "CAESURA" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "BLOWFISH" (Indicator: "blowfish"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "AESCULAPIUS" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "AESC" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3D885000.00000002.mdmp") Found string "AEsmall" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "ncompletaestudiosp" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp") Found string "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" (Indicator: "aes"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found string "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" (Indicator: "chacha"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2490000.00000004.mdmp, 00000000-00006920.00000001.170129.F2490000.00000004.mdmp, 00000000-00006920.00000002.172052.F2490000.00000004.mdmp, 00000000-00006920.00000003.178514.F2490000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F2590000.00000004.mdmp, 00000000-00006920.00000001.170129.4B0D4000.00000002.mdmp, 00000000-00006920.00000001.170129.F2590000.00000004.mdmp, 00000000-00006920.00000002.172052.F2590000.00000004.mdmp, 00000000-00006920.00000003.178514.39AA2000.00000002.mdmp, 00000000-00006920.00000003.178514.F237B000.00000004.mdmp, 00000000-00006920.00000003.178514.F2590000.00000004.mdmp")58:Tb3a,"TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\TIMINI-PRINT-GUI-WINDOWS-X86_64.EXE"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")59:T1b5f,"TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "63040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D7001F020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B012945010129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D2003555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C9760365D36800664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C0399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A3E71501A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03EF798B00F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503EA00060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E7403633E99006363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F9302928271009283510192C41401930547019369C70096390B01994664019AC657019B56A4009C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B0755E00B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E6B92B01E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100") "TiMini-Print-GUI-Windows-x86_64.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2CF83D3E2B72DD010000000000000000000000000200000000")5a:Td49,"VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006920] "_avif.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_avif.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imaging.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imaging.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_imagingft.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingft.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_webp.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_webp.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imagingcms.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingcms.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_decimal.pyd]- [targetUID: 00000000-00006920] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ssl.pyd]- [targetUID: 00000000-00006920] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_lzma.pyd]- [targetUID: 00000000-00006920] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_elementtree.pyd]- [targetUID: 00000000-00006920] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ctypes.pyd]- [targetUID: 00000000-00006920] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_bz2.pyd]- [targetUID: 00000000-00006920] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_socket.pyd]- [targetUID: 00000000-00006920] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_hashlib.pyd]- [targetUID: 00000000-00006920] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_asyncio.pyd]- [targetUID: 00000000-00006920] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_overlapped.pyd]- [targetUID: 00000000-00006920] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_multiprocessing.pyd]- [targetUID: 00000000-00006920] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_queue.pyd]- [targetUID: 00000000-00006920] "_imagingtk.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingtk.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488]5b:Td49,"VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006920] "_avif.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_avif.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imaging.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imaging.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_imagingft.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingft.cp311-win_amd64.pyd]- [targetUID: 00000000-00006920] "_webp.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_webp.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_imagingcms.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingcms.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_decimal.pyd]- [targetUID: 00000000-00006920] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ssl.pyd]- [targetUID: 00000000-00006920] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_lzma.pyd]- [targetUID: 00000000-00006920] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_elementtree.pyd]- [targetUID: 00000000-00006920] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_ctypes.pyd]- [targetUID: 00000000-00006920] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_bz2.pyd]- [targetUID: 00000000-00006920] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_socket.pyd]- [targetUID: 00000000-00006920] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_hashlib.pyd]- [targetUID: 00000000-00006920] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_asyncio.pyd]- [targetUID: 00000000-00006920] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_overlapped.pyd]- [targetUID: 00000000-00006920] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_multiprocessing.pyd]- [targetUID: 00000000-00006920] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\_queue.pyd]- [targetUID: 00000000-00006920] "_imagingtk.cp311-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000021282\PIL\_imagingtk.cp311-win_amd64.pyd]- [targetUID: 00000000-00008488]5c:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-10.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-14.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-13.enc" which has been seen in the context of ransomware (Indicator: .ENC)5d:T470,"TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "161"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "16"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "17"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "18"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "20"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "144"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "145"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "1"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "4"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "2"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "5"} "TiMini-Print-GUI-Windows-x86_64.exe" called "GetKeyState" with parameters {"nVirtKey": "6"}5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794436193772,"unified_at":"2026-11-11T22:29:53.772Z","metadata":{"hashes":{"sha256":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","sha1":"6574a50c0a4ba8ce76a07d99e63aef6edae3d07c","md5":"f3440c3e6a7775d710ec8ce42da42805","sha512":"fad2a6ccde9f7f2ad0a735b13c2504671e8e56f4bdb82120da03a4f498e29fe93145b3b624c3b4676e632500b0c4efba347e5b2464893b24190dc3e927f29a0f","ssdeep":"786432:jUW7uuzo7KW8QO1QtI1kQ9HgCuAHjvM8ax66jx+TX3G3cBrI2EP8DA:jsu87KWSiIaQ9pZHjpyjxMW3ci8","ssdeep_chunks":["786432:jUW7uuz","786432:UW7uuzo","786432:W7uuzo7","786432:7uuzo7K","786432:uuzo7KW","786432:uzo7KW8","786432:zo7KW8Q","786432:o7KW8QO","786432:7KW8QO1","786432:KW8QO1Q","786432:W8QO1Qt","786432:8QO1QtI","786432:QO1QtI1","786432:O1QtI1k","786432:1QtI1kQ","786432:QtI1kQ9","786432:tI1kQ9H","786432:I1kQ9Hg","786432:1kQ9HgC","786432:kQ9HgCu","786432:Q9HgCuA","786432:9HgCuAH","786432:HgCuAHj","786432:gCuAHjv","786432:CuAHjvM","786432:uAHjvM8","786432:AHjvM8a","786432:HjvM8ax","786432:jvM8ax6","786432:vM8ax66","786432:M8ax66j","786432:8ax66jx","786432:ax66jx+","786432:x66jx+T","786432:66jx+TX","786432:6jx+TX3","786432:jx+TX3G","786432:x+TX3G3","786432:+TX3G3c","786432:TX3G3cB","786432:X3G3cBr","786432:3G3cBrI","786432:G3cBrI2","786432:3cBrI2E","786432:cBrI2EP","786432:BrI2EP8","786432:rI2EP8D","786432:I2EP8DA","1572864:jUW7uuz","1572864:UW7uuzo","1572864:W7uuzo7","1572864:7uuzo7K","1572864:uuzo7KW","1572864:uzo7KW8","1572864:zo7KW8Q","1572864:o7KW8QO","1572864:7KW8QO1","1572864:KW8QO1Q","1572864:W8QO1Qt","1572864:8QO1QtI","1572864:QO1QtI1","1572864:O1QtI1k","1572864:1QtI1kQ","1572864:QtI1kQ9","1572864:tI1kQ9H","1572864:I1kQ9Hg","1572864:1kQ9HgC","1572864:kQ9HgCu","1572864:Q9HgCuA","1572864:9HgCuAH","1572864:HgCuAHj","1572864:gCuAHjv","1572864:CuAHjvM","1572864:uAHjvM8","1572864:AHjvM8a","1572864:HjvM8ax","1572864:jvM8ax6","1572864:vM8ax66","1572864:M8ax66j","1572864:8ax66jx","1572864:ax66jx+","1572864:x66jx+T","1572864:66jx+TX","1572864:6jx+TX3","1572864:jx+TX3G","1572864:x+TX3G3","1572864:+TX3G3c","1572864:TX3G3cB","1572864:X3G3cBr","1572864:3G3cBrI","1572864:G3cBrI2","1572864:3cBrI2E","1572864:cBrI2EP","1572864:BrI2EP8","1572864:rI2EP8D","1572864:I2EP8DA","786432:jsu87KW","786432:su87KWS","786432:u87KWSi","786432:87KWSiI","786432:7KWSiIa","786432:KWSiIaQ","786432:WSiIaQ9","786432:SiIaQ9p","786432:iIaQ9pZ","786432:IaQ9pZH","786432:aQ9pZHj","786432:Q9pZHjp","786432:9pZHjpy","786432:pZHjpyj","786432:ZHjpyjx","786432:HjpyjxM","786432:jpyjxMW","786432:pyjxMW3","786432:yjxMW3c","786432:jxMW3ci","786432:xMW3ci8"],"imphash":"e3e80a143805ea18936c8f612e25d363"},"file_info":{"file_name":"TiMini-Print-GUI-Windows-x86_64.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":37118296,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794435742000,"last_seen":1794435742000,"last_multi_scan":1794435742000},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":85},"sandbox_signatures":{"informative_count":173,"suspicious_count":16,"malicious_count":1,"total":190},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains references to pipe API string"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"Uses bzip2 compression library to compress data"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Process Argument Spoofing","attack_id":"T1564.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/010","identifiers":[{"type":"suspicious","value":"Detected a typical process argument spoofing API call sequence"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\"), Found reference to API \"K32EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\", Heuristic match: \"%s%c%s.py\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$37","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00006920.00000000.168210.36030000.00000004.mdmp, 00000000-00006920.00000001.170129.36030000.00000004.mdmp, 00000000-00006920.00000003.178514.36030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"TiMini-Print-GUI-Windows-x86_64.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$39","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertAddStoreToCollection\" (Indicator: \"CertAddStoreToCollection\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertEnumCRLsInStore\" (Indicator: \"CertEnumCRLsInStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertGetEnhancedKeyUsage\" (Indicator: \"CertGetEnhancedKeyUsage\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found api reference \"CertFreeCRLContext\" (Indicator: \"CertFreeCRLContext\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Encoding\" in header \"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1Accept-Encoding: identityHost: api.github.comUser-Agent: TiMini-Print/0.9.1Connection: close\"\n Contains base64 string in header \"identityHost\" in header \"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1Accept-Encoding: identityHost: api.github.comUser-Agent: TiMini-Print/0.9.1Connection: close\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"api.github.com\" (Indicator: \"github.com\"; File: \"PCAP\")\n Found string \"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1Accept-Encoding: identityHost: api.github.comUser-Agent: TiMini-Print/0.9.1Connection: close\" (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008488)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008488)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008488)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: TiMini-Print-GUI-Windows-x86_64.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00006920-00000C47-18710635387","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" queried token user identity (UID: 00000000-00008488)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" queried token user identity (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"CreateProcessW\" with parameter \"\"C:\\TiMini-Print-GUI-Windows-x86_64.exe\"\" - (UID: 00000000-00008488)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"140.82.114.5:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imaging.cp311-win_amd64.pyd)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imagingft.cp311-win_amd64.pyd)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006920-00000C47-18710635387\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006920-00000C47-18710635387\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$41","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00006920.00000000.168210.36030000.00000004.mdmp\n 00000000-00006920.00000001.170129.36030000.00000004.mdmp\n 00000000-00006920.00000003.178514.36030000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00006920.00000000.168210.36030000.00000004.mdmp\n 00000000-00006920.00000001.170129.36030000.00000004.mdmp\n 00000000-00006920.00000003.178514.36030000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$43","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"%TEMP%\\_MEI000021282\\python3\" - [base:0; Status:c0000135]\n \"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"python3\" - [base:0; Status:c0000135]\n \"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"%TEMP%\\_MEI000021282\\DLLs\\python3\" - [base:0; Status:c0000135]\n \"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"fribidi\" - [base:0; Status:c0000135]\n \"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"fribidi-0\" - [base:0; Status:c0000135]\n \"TiMini-Print-GUI-Windows-x86_64.exe\" failed to load missing module \"libfribidi-0\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$44","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$45","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 65700000\n \"TiMini-Print-GUI-Windows-x86_64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 64EC0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 65700000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 67610000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 67610000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a34365f87f0000@ntdll.dll\"\n \"220023000000000038a34365f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" touched \"QueryParserManager Class\" (Path: \"HKCU\\CLSID\\{5088B39A-29B4-4D9D-8245-4EE289222F66}\\TREATAS\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" touched \"Structured Query Helper Class\" (Path: \"HKCU\\CLSID\\{934D4698-6A59-48F8-9F29-9FB30670320E}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$49","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$4a","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4b","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1c2400\" greater than 0x100000\n Raw size of \".text\" is \"0x15d400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1c2268\" greater than 0x100000\n Virtual size of \".text\" is \"0x15d388\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$4d","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00006920-00000BC0-925926593]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00006920-00000C47-18710635387]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00006920-00000C47-18710635387]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 00000000-00006920) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\TiMini-Print-GUI-Windows-x86_64.exe\", USERDNSDOMAIN=\"hm9uOyLqPhzS5mY\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI000021282\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 00000000-00006920) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00007892) was launched with new environment variables: \"TCL_LIBRARY=\"%TEMP%\\_MEI000021282\\_tcl_data\", TK_LIBRARY=\"%TEMP%\\_MEI000021282\\_tk_data\", HOME=\"C:\\Users\\x3hq0DA\"\"\n Process \"cmd.exe\" (UID: 00000000-00007892) was launched with modified environment variables: \"_PYI_PARENT_PROCESS_LEVEL\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 00000000-00006920)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00007892)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 00000000-00006920)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00007892)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Server Authentication CA DV E36, O=Sectigo Limited, C=GB\" (SHA1: 05:2F:E1:40:0F:8C:3C:5E:94:67:16:3B:69:24:27:CF:08:86:5A:3F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB\" (SHA1: 56:63:48:E6:56:E1:FA:6C:4E:2E:E6:72:59:16:E8:F4:E3:73:8A:07; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 3F:96:99:89:F5:31:0E:9C:05:0D:FF:D7:AB:C1:55:30:E3:C1:3A:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000021282\\PIL\\_avif.cp311-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"VCRUNTIME140_1.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- Location: [%TEMP%\\_MEI000021282\\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006920]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000021282\\PIL\\_avif.cp311-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" queries basic process information of the \"C:\\TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 8488)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" queries basic process information of the \"C:\\TiMini-Print-GUI-Windows-x86_64.exe\" (UID: 6920)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 6920)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 7892)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" reads file \"c:\\timini-print-gui-windows-x86_64.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\0\"\n \"TiMini-Print-GUI-Windows-x86_64.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\1033\"\n \"TiMini-Print-GUI-Windows-x86_64.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000021282\\pil\\_avif.cp311-win_amd64.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; File: \"kl.msg\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /repos/Dejniel/TiMini-Print/releases/latest\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"CURL\" (Indicator: \"curl\") in Source: 00000000-00006920.00000000.168210.3D885000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Contains references to pipe API string","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$55","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1\nAccept-Encoding: identity\nHost: api.github.com\nUser-Agent: TiMini-Print/0.9.1\nConnection: close\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"api.github.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.github.com\" (14 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.github.com/repos/Dejniel/TiMini-Print/releases/latest","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.github.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"140.82.114.5\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"_imaging.cp311-win_amd64.pyd\"\n YARA signature for file using Zlib compression matched on file \"_imagingft.cp311-win_amd64.pyd\"\n YARA signature for file using Zlib compression matched on process \"00000000-00006920\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"FINGER\" (Indicator: \"finger\") in Source: 00000000-00006920.00000000.168210.3D885000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"Found string \"%TEMP%\\_MEI000021282\\bleak\\backends\\p4android\\java\\com\\github\\hbldh\" (Indicator: \"github\\\"; Source: \"00000000-00008488-00000C3F-16916354232\")\n Found string \"%TEMP%\\_MEI000021282\\bleak\\backends\\p4android\\java\\com\\github\\hbldh\\bleak\" (Indicator: \"github\\\"; Source: \"00000000-00008488-00000C3F-16917854564\")","origin":"File/Memory","mitre_attack_id":"T1213.003","relevance":1,"id":"string-774","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: TiMini-Print-GUI-Windows-x86_64.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 5B9F0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: TiMini-Print-GUI-Windows-x86_64.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp, 00000000-00006920.00000000.168210.4C99D000.00000002.mdmp, 00000000-00006920.00000000.168210.F1E90000.00000004.mdmp, 00000000-00006920.00000001.170129.F1E90000.00000004.mdmp, 00000000-00006920.00000001.170129.F57E0000.00000002.mdmp, 00000000-00006920.00000003.178514.4AF67000.00000002.mdmp, 00000000-00006920.00000003.178514.F1E90000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp\")\n Found string \"stratesecretar\" (Indicator: \"secret\"; Source: \"00000000-00006920.00000000.168210.3DAFF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: TiMini-Print-GUI-Windows-x86_64.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: TiMini-Print-GUI-Windows-x86_64.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"TiMini-Print-GUI-Windows-x86_64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"2CF83D3E2B72DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: TiMini-Print-GUI-Windows-x86_64.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"TiMini-Print-GUI-Windows-x86_64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"AreFileApisANSI\" (Source: TiMini-Print-GUI-Windows-x86_64.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: TiMini-Print-GUI-Windows-x86_64.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: TiMini-Print-GUI-Windows-x86_64.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: TiMini-Print-GUI-Windows-x86_64.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: TiMini-Print-GUI-Windows-x86_64.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Detected a typical process argument spoofing API call sequence","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" (Thread: 1000) invoked API sequence (NtCreateUserProcess -> NtWriteVirtualMemory -> NtResumeThread)","origin":"API Call","mitre_attack_id":"T1564.010","relevance":9,"id":"api-9005","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".data\" has very low entropy (0.92)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" has section name .rsrc with entropy \"7.5548822354346745\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\_MEI000021282\\PIL\\_avif.cp311-win_amd64.pyd\" has high entropy 7.01449","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00006920.00000002.172052.5080D000.00000002.mdmp\" at offset 3524; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" has resource with unusual entropy \"RT_ICON:7.950949195950686\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000021282\\PIL\\_avif.cp311-win_amd64.pyd\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.82.114.5 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00006920\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted a file with a known ransomware suffix","description":"$5c","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5010b19\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"$5d","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"VCRUNTIME140_1.dll\" claimed CRC 37162375 while the actual is CRC 107245\n \"_imaging.cp311-win_amd64.pyd\" claimed CRC 107245 while the actual is CRC 2726170\n \"_ssl.pyd\" claimed CRC 314467 while the actual is CRC 213004\n \"_lzma.pyd\" claimed CRC 213004 while the actual is CRC 198186\n \"_elementtree.pyd\" claimed CRC 198186 while the actual is CRC 138865\n \"_ctypes.pyd\" claimed CRC 138865 while the actual is CRC 164563\n \"_bz2.pyd\" claimed CRC 164563 while the actual is CRC 133629\n \"_socket.pyd\" claimed CRC 133629 while the actual is CRC 116986\n \"_hashlib.pyd\" claimed CRC 116986 while the actual is CRC 66284\n \"_asyncio.pyd\" claimed CRC 66284 while the actual is CRC 115363\n \"_overlapped.pyd\" claimed CRC 115363 while the actual is CRC 87771\n \"_multiprocessing.pyd\" claimed CRC 87771 while the actual is CRC 46568\n \"_queue.pyd\" claimed CRC 46568 while the actual is CRC 55694\n \"_imagingtk.cp311-win_amd64.pyd\" claimed CRC 55694 while the actual is CRC 37882","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateToolhelp32Snapshot\n TerminateProcess\n FindNextFileW\n GetCommandLineW\n GetModuleHandleW\n OpenProcess\n GetModuleFileNameW\n CreateDirectoryW\n DeleteFileW\n GetTempPathW\n GetFileSizeEx\n Sleep\n GetDriveTypeW\n CreateFileW\n UnhandledExceptionFilter\n LoadLibraryExW\n Process32NextW\n FindFirstFileExW\n WriteFile\n Process32FirstW\n GetStartupInfoW\n CreateProcessW\n GetFileAttributesExW\n GetModuleHandleExW\n GetProcAddress\n VirtualProtect\n IsDebuggerPresent\n FindFirstFileW\n GetCommandLineA\n GetCursorPos\n CreateFileMappingA\n LoadLibraryA\n GetModuleHandleA\n SleepConditionVariableCS\n GetSystemInfo\n MapViewOfFile\n GetClipboardData\n CreateFileA\n GetFileSize\n VirtualAlloc\n GetComputerNameExW\n socket\n closesocket\n send\n connect\n sendto\n accept\n WSAStartup\n recvfrom\n bind\n listen\n WSASocketW\n recv\n ConnectNamedPipe\n WSASend\n WSASendTo","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"VCRUNTIME140_1.dll\" claims program is from Mon Sep 10 13:35:28 2103","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"TiMini-Print-GUI-Windows-x86_64.exe\" wrote 000011C0 bytes to a remote process \"C:\\TiMini-Print-GUI-Windows-x86_64.exe\" (Handle: 476)\n \"TiMini-Print-GUI-Windows-x86_64.exe\" wrote 00000008 bytes to a remote process \"C:\\TiMini-Print-GUI-Windows-x86_64.exe\" (Handle: 476)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"intel_graph":{"map":{"Domain:api.github.com":{"type":"Domain","value":"api.github.com"},"File:00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3":{"type":"File","value":"00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3"},"File:02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0":{"type":"File","value":"02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0"},"File:16d5b7d58c89b2d01599dd7fcc536842af00b9c81464b94290ec23210d0d3f2b":{"type":"File","value":"16d5b7d58c89b2d01599dd7fcc536842af00b9c81464b94290ec23210d0d3f2b"},"File:1ead5ef5fb2b0b40d5a92c4baa5e4e111b187e9f9f4e895a1ab8cea8e12318f2":{"type":"File","value":"1ead5ef5fb2b0b40d5a92c4baa5e4e111b187e9f9f4e895a1ab8cea8e12318f2"},"File:2d5846f349212f73e613ab18076851d360d3deb0dd7b41db76357ed06e65f39d":{"type":"File","value":"2d5846f349212f73e613ab18076851d360d3deb0dd7b41db76357ed06e65f39d"},"File:3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c":{"type":"File","value":"3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c"},"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048":{"type":"File","value":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048"},"File:517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c":{"type":"File","value":"517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c"},"File:6661a925b55bc9c0465699a64327b3b7602d1b04391caf5ab88efa77e8569838":{"type":"File","value":"6661a925b55bc9c0465699a64327b3b7602d1b04391caf5ab88efa77e8569838"},"File:6b2b71a29b684727c100cbe2810a69cde03d32fd489150f90ef7ca155556a5fe":{"type":"File","value":"6b2b71a29b684727c100cbe2810a69cde03d32fd489150f90ef7ca155556a5fe"},"File:746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403":{"type":"File","value":"746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403"},"File:87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766":{"type":"File","value":"87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766"},"File:975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9":{"type":"File","value":"975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9"},"File:980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278":{"type":"File","value":"980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278"},"File:a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5":{"type":"File","value":"a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5"},"File:a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166":{"type":"File","value":"a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166"},"File:ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678":{"type":"File","value":"ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678"},"File:c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7":{"type":"File","value":"c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7"},"File:ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164":{"type":"File","value":"ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164"},"File:d3a5ebaf8a550fe1e3a5baed6eac89e6e21a5ccd3c8f8f22ae577a57248173c7":{"type":"File","value":"d3a5ebaf8a550fe1e3a5baed6eac89e6e21a5ccd3c8f8f22ae577a57248173c7"},"File:f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5":{"type":"File","value":"f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5"},"Ip:140.82.114.5":{"type":"Ip","value":"140.82.114.5"},"Url:/repos/Dejniel/TiMini-Print/releases/latest":{"type":"Url","value":"/repos/Dejniel/TiMini-Print/releases/latest"}},"chains":[{"id":"sandbox_network","root":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","edges":[{"edge_kind":"contacted_ip","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"Ip:140.82.114.5"},{"edge_kind":"contacted_domain","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"Domain:api.github.com"},{"edge_kind":"resolves_to","from_key":"Domain:api.github.com","to_key":"Ip:140.82.114.5"},{"edge_kind":"contacted_url","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"Url:/repos/Dejniel/TiMini-Print/releases/latest"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","edges":[{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:16d5b7d58c89b2d01599dd7fcc536842af00b9c81464b94290ec23210d0d3f2b"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:1ead5ef5fb2b0b40d5a92c4baa5e4e111b187e9f9f4e895a1ab8cea8e12318f2"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:6b2b71a29b684727c100cbe2810a69cde03d32fd489150f90ef7ca155556a5fe"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:6661a925b55bc9c0465699a64327b3b7602d1b04391caf5ab88efa77e8569838"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:d3a5ebaf8a550fe1e3a5baed6eac89e6e21a5ccd3c8f8f22ae577a57248173c7"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:2d5846f349212f73e613ab18076851d360d3deb0dd7b41db76357ed06e65f39d"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678"},{"edge_kind":"extracted","from_key":"File:4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","to_key":"File:517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":241,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af4ea998cf384d9960c2934","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"TiMini-Print-GUI-Windows-x86_64.exe","analysis_start_time":"2026-11-11T22:22:24+00:00","indicators_count":{"informative":172,"suspicious":34,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"140.82.114.5","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"dns_resolutions":[{"domain":"api.github.com","address":"140.82.114.5","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"http_requests":[{"host":"api.github.com","host_ip":"140.82.114.5:443","url":"/repos/Dejniel/TiMini-Print/releases/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/Dejniel/TiMini-Print/releases/latest HTTP/1.1\nAccept-Encoding: identity\nHost: api.github.com\nUser-Agent: TiMini-Print/0.9.1\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}],"processes":[{"pid":8488,"ppid":0,"name":"TiMini-Print-GUI-Windows-x86_64.exe","command_line":"","sha256":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","normalized_path":"C:\\TiMini-Print-GUI-Windows-x86_64.exe","uid":"00000000-00008488","icon":"$5e"},{"pid":6920,"ppid":8488,"name":"TiMini-Print-GUI-Windows-x86_64.exe","command_line":"","sha256":"4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048","normalized_path":"C:\\TiMini-Print-GUI-Windows-x86_64.exe","parent_uid":"00000000-00008488","uid":"00000000-00006920"},{"pid":7892,"ppid":6920,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006920","uid":"00000000-00007892"}],"all_imported_dlls":["sechost.dll","cryptsp.dll","version.dll","IPHLPAPI.DLL","libcrypto-3.dll","wldp.dll","Windows.Networking.HostName.dll","bcryptprimitives.dll","shell32.dll","CoreMessaging.dll","BluetoothApis.dll","nsi.dll","Windows.Networking.Connectivity.dll","ucrtbase.dll","comctl32.dll","uxtheme.dll","VCRUNTIME140_1.dll","tcl86t.dll","dnsapi.dll","ntdll.dll","gdi32.dll","advapi32.dll","imm32.dll","VCRUNTIME140.dll","libssl-3.dll","tk86t.dll","logoncli.dll","ws2_32.dll","kernel.appcore.dll","vcruntime140.dll","kernel32.dll","comdlg32.dll","netapi32.dll","userenv.dll","samcli.dll","windows.storage.dll","rometadata.dll","TextInputFramework.dll","fltLib.dll","combase.dll","SHCore.dll","cfgmgr32.dll","biwinrt.dll","FirewallAPI.dll","propsys.dll","rpcrt4.dll","VxSSL64.dll","FWPUCLNT.DLL","StructuredQuery.dll","msvcp140.dll","python311.dll","Windows.Devices.Bluetooth.dll","Windows.Networking.dll","KernelBase.dll","win32u.dll","CoreUIComponents.dll","clbcatq.dll","msasn1.dll","profapi.dll","oleaut32.dll","shlwapi.dll","libffi-8.dll","mswsock.dll","ntmarta.dll","devobj.dll","rasadhlp.dll","Windows.Devices.Enumeration.dll","user32.dll","gdi32full.dll","vcruntime140_1.dll","msctf.dll","crypt32.dll","netutils.dll","msvcrt.dll","bcrypt.dll","ole32.dll","MSWB7.dll","msvcp_win.dll","WinTypes.dll","fwbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_avif.cp311-win_amd64.pyd","sha256":"16d5b7d58c89b2d01599dd7fcc536842af00b9c81464b94290ec23210d0d3f2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_imaging.cp311-win_amd64.pyd","sha256":"1ead5ef5fb2b0b40d5a92c4baa5e4e111b187e9f9f4e895a1ab8cea8e12318f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_imagingcms.cp311-win_amd64.pyd","sha256":"6b2b71a29b684727c100cbe2810a69cde03d32fd489150f90ef7ca155556a5fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_imagingft.cp311-win_amd64.pyd","sha256":"6661a925b55bc9c0465699a64327b3b7602d1b04391caf5ab88efa77e8569838","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_imagingtk.cp311-win_amd64.pyd","sha256":"d3a5ebaf8a550fe1e3a5baed6eac89e6e21a5ccd3c8f8f22ae577a57248173c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_webp.cp311-win_amd64.pyd","sha256":"2d5846f349212f73e613ab18076851d360d3deb0dd7b41db76357ed06e65f39d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"VCRUNTIME140_1.dll","sha256":"a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_asyncio.pyd","sha256":"746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_bz2.pyd","sha256":"00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_ctypes.pyd","sha256":"c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_decimal.pyd","sha256":"980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_elementtree.pyd","sha256":"02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_hashlib.pyd","sha256":"87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_lzma.pyd","sha256":"f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_multiprocessing.pyd","sha256":"975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_overlapped.pyd","sha256":"ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_queue.pyd","sha256":"3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_socket.pyd","sha256":"a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"_ssl.pyd","sha256":"ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"auto.tcl","sha256":"517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_avif.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_imaging.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_imagingcms.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_imagingft.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_imagingtk.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\PIL\\_webp.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-11.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\history.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\init.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\he.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\hi.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\hi_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\hr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\hu.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\id.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\id_id.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\is.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\it.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\it_ch.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ja.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kl_gl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ko.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ko_kr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kok.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kok_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kw.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\kw_gb.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\lt.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\lv.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\mk.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\mr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\mr_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ms.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ms_my.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\mt.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\nb.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\nl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\nl_be.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\nn.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\pl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\pt.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\pt_br.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ro.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ru.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ru_ua.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sh.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sk.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sl.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sq.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sv.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\sw.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ta.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\ta_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\te.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\te_in.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\th.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\tr.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\uk.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\vi.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\zh.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\zh_cn.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\zh_hk.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\zh_sg.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\msgs\\zh_tw.msg","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\opt0.4\\optparse.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\opt0.4\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\package.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\parray.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\safe.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\tclIndex","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"path":"%TEMP%\\_MEI000021282\\_tcl_data\\tm.tcl","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"Local\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"SM0:6920:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"Local\\SM0:6920:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]},{"name":"SM0:7892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4ea998cf384d9960c2934"}]}]}},"report_ids":{"sandbox_job_ids":["6af4ea998cf384d9960c2934"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 4a7344b0023d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4a7344b0023d…. Threat score 100/100. 0/25 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 4a7344b0023d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4a7344b0023d…. Threat score 100/100. 0/25 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4a7344b0023deab053d19bf29a798cfb14551ebd5728a3262c35e5ba790a7048"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 4a7344b0023d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4a7344b0023d…. Threat score 100/100. 0/25 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]] 32:null