24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 54ff03435943… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 54ff03435943…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/1 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542"],"about":{"@type":"SoftwareApplication","name":"joyn_downloader.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":1,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta7e,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "Is returned by ZipFile.open()." (Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found string "ZipFile subclass to ensure implicit" (Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string ">>> Path(zipfile.ZipFile(io.BytesIO(), 'w')) == 'foo'" (Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "interface to ``ZipFile``. Only the read interface is implemented." (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "unknown compression type %r" (Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "unsupported compression method" (Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "Small proxy class that enables transparent compression" (Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "compressions" (Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "Exception for unavailable compression methods." (Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp") Found string ";Brotli >= 1.2.0 is required to prevent decompression bombs." (Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000002.198921.81312000.00000004.mdmp") Found string "ZipFile" (Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000000.195936.FFC00000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.FFB00000.00000004.mdmp, 00000000-00001212.00000001.197856.FFC00000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp, 00000000-00001212.00000002.198921.FFB00000.00000004.mdmp")26:T76d,"joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\certifi (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\charset_normalizer (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Cipher (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Hash (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Math (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Protocol (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\PublicKey (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Util (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\Crypto (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\google\_upb (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\google (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor\jaraco\text (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor\jaraco (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842\setuptools (UID: 00000000-00000384) "joyn_downloader.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI3842 (UID: 00000000-00000384)27:T1027,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_SHA512.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_SHA384.pyd") file/memory contains long string with (Indicator: "RC2"; File: "_raw_arc2.pyd") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "joyn_downloader.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "joyn_downloader.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "joyn_downloader.exe") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "joyn_downloader.exe") Found reference to "bCrypto\Hash\_SHA384.pyd" (Indicator: "SHA384"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found reference to "bCrypto\Hash\_SHA512.pyd" (Indicator: "SHA512"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found reference to ""PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC" (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp 00000000-00001212.00000001.197856.805E0000.00000004.mdmp"), Found reference to "The object used to calculate HMAC of a message." (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp 00000000-00001212.00000002.198921.9E887000.00000002.mdmp"), Found reference to "EXPECTING_AN_HMAC_KEY" (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp 00000000-00001212.00000001.197856.9E45D000.00000002.mdmp 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp"), Found reference to "An HMAC hash object." (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp 00000000-00001212.00000001.197856.810A0000.00000004.mdmp 00000000-00001212.00000002.198921.80F30000.00000004.mdmp"), Found reference to ":ivar oid: the ASN.1 object ID of the HMAC algorithm." (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp 00000000-00001212.00000001.197856.810A0000.00000004.mdmp 00000000-00001212.00000002.198921.80F30000.00000004.mdmp 00000000-00001212.00000002.198921.810A0000.00000004.mdmp"), Found reference to "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\Crypto\Hash\__pycache__\HMAC.cpython-313.pyc" (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp 00000000-00001212.00000002.198921.80F30000.00000004.mdmp"), Found reference to "Returns 2 Context Data used for computing the AES Encryption and HMAC Keys." (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp 00000000-00001212.00000002.198921.80F30000.00000004.mdmp"), Found reference to "``'PBKDF2WithHMAC-SHA512AndAES256-CBC'``." (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp"), Found reference to "``'PBKDF2WithHMAC-SHA512AndAES256-CBC'``." (Indicator: "SHA512"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp"), Found reference to "- if ``format='DER'`` the ``'PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC'``" (Indicator: "HMAC"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp")28:T5f0,"joyn_downloader.exe" queried SystemProcessInformation at 00000000-00000384-00000C15-2048188585 [PID: 384] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00000384-00000C15-2048196938 [PID: 384] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00000384-00000C15-2048288547 [PID: 384] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00000384-00000C15-2048297741 [PID: 384] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052106282 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052113713 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052201008 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052211804 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052521596 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2052529399 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2053763353 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2053771400 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2053941780 [PID: 1212] "joyn_downloader.exe" queried SystemProcessInformation at 00000000-00001212-00000C15-2053950849 [PID: 1212]29:Tef9,Found string "RSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.810A0000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found string "&PKCS#1 private key cannot be encrypted" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.810A0000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.810A0000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.810A0000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found string "to decrypt using a public key)." (Indicator: "public key"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found string "Only suitable for public keys (not private keys)." (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "Only suitable for public keys (not private keys)." (Indicator: "public key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "(*Private keys only*) The passphrase to protect the" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "private key." (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "(*Private keys only*) The standard to use for" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "With ``pkcs=1`` (*default*), the private key is encoded with a" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "With ``pkcs=8``, the private key is encoded with a `PKCS#8`_ structure" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "This parameter is ignored for a public key." (Indicator: "public key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "(*For private keys only*)" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "The encryption scheme to use for protecting the private key" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "If you don't provide a pass phrase, the private key will be" (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "Private Key is required, the WVD does not contain one or is malformed." (Indicator: "private key"; Source: "00000000-00001212.00000000.195936.819C0000.00000004.mdmp, 00000000-00001212.00000002.198921.819C0000.00000004.mdmp")2a:T10f57,Found XOR loop in file "python313.dll" at offset 1654052; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2337244; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2970863; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3570979; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3764969; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3860314; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3914177; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3990023; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4028772; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4034115; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4108517; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4361019; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4381503; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4444887; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4455749; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4473633; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4598921; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4609307; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4645570; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4645640; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4673508; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4686459; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 179221; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 182022; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 185596; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 198820; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 199349; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 202374; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 256552; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 257540; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 277211; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 279032; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 280348; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 294908; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 301308; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 303799; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 331618; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 346465; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 438602; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 584776; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 587915; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 647653; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 733140; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 735127; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 735265; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 740551; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 742298; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1107866; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108203; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108271; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108347; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108403; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108464; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108821; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1108898; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1109110; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1109176; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1109375; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1109766; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1110054; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1110487; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1110577; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1110641; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1110790; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111152; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111249; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111550; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111761; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112141; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112562; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112611; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112963; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113046; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113162; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113210; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113277; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113641; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113709; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113794; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113838; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113934; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114275; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114343; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114424; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114486; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114570; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114792; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114885; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114888; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114924; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114987; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115010; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115069; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115096; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1126469; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1126585; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1126946; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1127066; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1129340; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133470; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133534; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133602; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133663; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133724; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133785; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133841; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133905; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133968; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134085; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134143; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134216; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134336; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134463; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134593; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134720; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134850; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1134981; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1135126; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1135170; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1135248; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1135375; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1136672; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1136743; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1136873; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1136996; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137124; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137172; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137252; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137310; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137375; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137429; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137498; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137556; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137621; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137672; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137748; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137872; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1137992; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138128; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138255; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138390; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138455; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138506; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138558; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138629; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1138928; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1139566; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1139645; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1139787; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1139863; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1139936; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140006; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140054; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140135; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140200; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140255; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140306; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140369; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140427; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140500; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140554; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140630; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140753; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1140880; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141004; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141131; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141261; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141384; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141515; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141642; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141776; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141834; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141911; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1141958; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142536; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142601; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142677; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142753; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142821; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142890; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1142977; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143057; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143093; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143149; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143222; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143270; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143345; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143406; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143464; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143605; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143722; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143842; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1143968; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144102; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144166; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144234; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144278; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144341; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144468; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144529; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144604; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144652; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144715; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144784; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144867; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144932; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1144998; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1145067; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1145135; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1145472; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1145675; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146360; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146524; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146589; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146665; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146711; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146787; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146845; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146911; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1146959; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147033; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147091; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147155; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147206; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147277; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147335; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147401; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147452; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147521; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147578; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147648; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147706; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147779; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147833; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147892; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1147950; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148020; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148068; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148146; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148194; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148264; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148318; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1148402; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234576; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1240768; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1243881; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1290781; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1290837; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1290938; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1290986; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291048; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291354; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291431; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291515; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291540; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291590; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291652; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291881; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1291936; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292012; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292111; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292159; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292209; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292529; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292603; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292706; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292754; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1292815; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293126; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293206; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293304; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293353; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293408; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293705; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293934; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1293995; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294304; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294378; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294482; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294530; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294591; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294910; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1294969; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295074; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295130; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295187; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295524; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295614; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295656; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295730; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1295781; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1296082; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1296169; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1296242; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1296308; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1305168; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1305420; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1305502; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1305637; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1305768; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1366483; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1443833; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1479773; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1482129; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1491324; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1524223; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1524342; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1525228; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1570265; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1581056; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1781262; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1829076; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1917626; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1918314; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1919902; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1990937; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2141073; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2141214; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2162329; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2162859; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2162915; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2342417; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2474381; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2690001; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2743309; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 3850222; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4022082; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4033437; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 889420; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1046899; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1446341; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658199; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658280; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658361; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658519; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658597; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658755; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658833; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658914; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1658995; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659076; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659157; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659238; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659319; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659400; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659481; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659562; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659643; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659724; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659885; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1659966; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660047; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660128; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660289; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660370; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660451; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660532; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660613; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660694; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660775; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660856; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1660937; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1661018; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1790908; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1794580; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1874670; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2063310; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2327636; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2853968; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3558591; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3570846; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3578043; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3764768; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3828843; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3904737; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3914044; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4033982; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4108384; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 5184152; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 5212808; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 34940; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 253092; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 391780; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 1859962; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 2929174; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3149339; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166542; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3841605; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4176120; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546628; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546656; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546676; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4966712; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5000988; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5106200; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 76497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78006; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203177; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227636; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 240728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 244259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 246267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 249337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 265789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 509088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564361; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564811; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565943; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566099; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566255; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567538; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568681; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707940; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707946; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767603; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 768225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1018292; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1019593; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1019665; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1022739; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1088008; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1088274; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089478; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089883; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090420; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092830; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337945; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339763; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339807; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339856; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340210; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340362; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340814; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340966; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341414; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341566; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341868; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342649; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342799; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342951; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343101; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343253; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343555; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343705; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343857; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344007; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344159; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344309; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346484; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346776; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347068; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347506; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347652; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347944; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348090; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348408; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348554; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348700; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348846; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348992; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349576; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349722; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349868; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350014; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350160; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350306; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359033; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359037; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359053; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359059; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359076; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359085; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1362891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364675; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365474; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365505; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365569; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1369609; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1369858; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1398753; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1476438; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1863039; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1863071; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864197; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1870927; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1870959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2151023; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2151034; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2152131; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2195987; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269472; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269544; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269553; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269618; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270007; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270092; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270274; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2271522; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297578; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297713; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2311149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515409; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515645; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516151; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516308; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516570; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516701; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517551; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517597; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517734; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517993; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518068; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518114; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518211; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518332; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518458; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518596; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518718; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519015; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519156; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519278; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519783; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519829; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519845; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519928; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519980; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520242; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521009; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521148; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521275; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521520; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2570559; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2570623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2584527; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2584623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2636890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660373; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675820; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675828; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2955252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083213; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083318; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083355; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083445; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083586; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083616; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083697; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083929; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084015; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084137; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084285; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084508; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084609; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084660; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084721; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084832; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084950; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085411; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085466; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085517; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085579; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085640; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085751; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085806; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085880; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085997; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086067; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086479; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086526; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086579; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086707; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086823; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086934; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087084; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087209; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087328; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087666; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087784; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087899; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087949; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088011; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088279; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088348; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088460; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088569; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088684; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088814; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089056; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089305; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089441; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089547; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090120; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090349; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090589; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091205; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091326; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091479; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091572; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092489; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092607; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092715; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092860; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092961; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093012; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093074; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093193; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093300; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093418; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093825; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093877; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093937; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094000; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094139; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094194; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094324; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100056; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100178; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100266; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100315; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100366; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100678; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100754; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100800; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100879; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100988; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101184; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101280; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101377; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101698; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101812; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102141; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102205; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102246; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102287; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102504; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102800; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102903; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103014; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103101; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103453; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103883; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104294; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104613; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104662; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104714; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104769; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104898; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104965; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105298; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105393; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106628; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106724; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106819; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106982; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107020; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107076; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107179; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107220; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107288; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107350; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107585; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107644; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107687; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107732; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107823; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107920; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107999; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3249183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3249215; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3250386; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3257423; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3257455; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3258809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3431494; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3544483; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3544563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3566521; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588387; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3589143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3589670; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590058; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590061; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590067; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3597078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3597240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3711947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3818240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3843276; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4083624; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4789796; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 5224382; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 253212; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 307435; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 363114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 939328; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1361709; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1701030; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2028416; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3595020; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4196978; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4198385; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4199024; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4462152; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4462312; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4464088; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4464208; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4769372; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4988324; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4990860; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5002176; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5067456; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105033; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105041; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105045; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5219675; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5228965; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 341740; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 36115; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 36195; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 285131; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314499; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314611; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 315255; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 315782; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316170; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316173; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316179; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516270; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516432; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 787902; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 267573; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 732136; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 783195; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 792485; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 65470; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 60763; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 70029; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-math-l1-1-0.dll" at offset 25926; code bytes = 8030 Found XOR loop in file "api-ms-win-core-file-l1-1-0.dll" at offset 21845; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-convert-l1-1-0.dll" at offset 21845; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-stdio-l1-1-0.dll" at offset 21845; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-string-l1-1-0.dll" at offset 21830; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-runtime-l1-1-0.dll" at offset 21829; code bytes = 8030 Found XOR loop in file "api-ms-win-core-profile-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-file-l1-2-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-errorhandling-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-heap-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-synch-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-sysinfo-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-timezone-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-rtlsupport-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-locale-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-debug-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-debug-l1-1-0.dll" at offset 20807; code bytes = 8030 Found XOR loop in file "api-ms-win-core-synch-l1-2-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-memory-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-datetime-l1-1-0.dll" at offset 17733; code bytes = 80302b:T6f4,Found string "https://github.com/python/importlib_metadata/wiki/Development-Methodology" (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.809E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.809E0000.00000004.mdmp") Found string "https://github.com/pypa/packaging" (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "of cls.__bases__. See https://github.com/pypa/setuptools/issues/1024." (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "https://github.com/pypa/setuptools/discussions/5011" (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "at ." (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found string "https://github.com/construct/construct" (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.819C0000.00000004.mdmp, 00000000-00001212.00000002.198921.819C0000.00000004.mdmp") Found string "`get_connection` has been deprecated in favor of `get_connection_with_tls_context`. Custom HTTPAdapter subclasses will need to migrate for Requests>=2.32.2. Please see https://github.com/psf/requests/pull/6710 for more details." (Indicator: "github.com"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp")2c:T669,Found string "etUserNameW" (Source: "00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "etUserNameExW" (Source: "00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "WMake a new IOSVersionInfo object from a sequence or iterable" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo.__new__" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo._make" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo(system, release, model, is_simulator)" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.809E0000.00000004.mdmp, 00000000-00001212.00000002.198921.809E0000.00000004.mdmp") Found string "IOSVersionInfo._asdict" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo.__repr__" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "IOSVersionInfo._replace" (Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp")2d:T9fa,"joyn_downloader.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000384) "joyn_downloader.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000384) "joyn_downloader.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001212) "joyn_downloader.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001212)2e:Tedf,"joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049101104 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049105202 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049108510 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049108972 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049114093 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049114588 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049118155 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049118626 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049124790 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049125267 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049128556 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049129030 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049132178 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049132648 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049136286 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049136761 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049140849 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049141352 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049162077 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049162548 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049165982 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049166536 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-2049171226 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher" at 00000000-00000384-00000C17-2049172650 "joyn_downloader.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto" at 00000000-00000384-00000C17-20491795092f:T7cb,"joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842 (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Cipher (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Hash (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Math (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Protocol (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\PublicKey (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\Crypto\Util (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\certifi (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\charset_normalizer (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\google (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\google\_upb (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\setuptools (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor\jaraco (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI3842\setuptools\_vendor\jaraco\text (UID: 00000000-00000384) "joyn_downloader.exe" called "CreateDirectoryW" with parameter auth (UID: 00000000-00001212)30:T1332,"joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000384) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000384) "joyn_downloader.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000384) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\ucrtbase.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\python313.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\python3 (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_ctypes.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_bz2.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_lzma.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_queue.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_wmi.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_hashlib.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_socket.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\select.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_ssl.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_uuid.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Util\_cpuid_c.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Cipher\_raw_aes.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Cipher\_raw_aesni.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Util\_strxor.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Hash\_SHA1.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Cipher\_pkcs1_decode.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Hash\_BLAKE2s.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Hash\_SHA256.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\Crypto\Math\_modexp.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\google\_upb\_message.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\_elementtree.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\pyexpat.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\charset_normalizer\cd.cp313-win_amd64.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI3842\unicodedata.pyd (UID: 00000000-00001212) "joyn_downloader.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001212)31:T2e73,"joyn_downloader.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000384) "joyn_downloader.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter VirtualAlloc2FromApp (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemoryEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetNumaProcessorNodeEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMaskEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetNumaProcessorNode (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_Clear (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_InitIsolatedConfig (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_Read (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_SetBytesString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_SetString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyConfig_SetWideStringList (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_InitializeFromConfig (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter Py_ExitStatusException (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__wmi (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter have_aes_ni (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__message (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit__elementtree (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit_pyexpat (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit_cd (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit_ada92cb5d92a588d1b93__mypyc (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter SetConsoleCursorPosition (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter FillConsoleOutputCharacterA (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter FillConsoleOutputAttribute (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001212) "joyn_downloader.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001212)32:T5d6,"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem" (Source: 00000000-00001212-00002714-2054184192, Indicator: "select version,producttype,buildtype,servicepackmajorversion,servicepackminorversion from win32_operatingsystem") "SELECT Architecture FROM Win32_Processor" (Source: 00000000-00001212-00002714-2054298837, Indicator: "select architecture from win32_processor") "Insert an entry into the list of warnings filters (at the front)." (Source: 00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp, Indicator: "insert an entry into the list of warnings filters (at the front)."), "SELECT {} FROM {}" (Source: 00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp, Indicator: "select {} from {}"), "Select entry points from self that match the" (Source: 00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80886000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp, Indicator: "select entry points from self that match the"), "inserted into this container." (Source: 00000000-00001212.00000000.195936.819C0000.00000004.mdmp, 00000000-00001212.00000001.197856.81AD0000.00000004.mdmp, 00000000-00001212.00000002.198921.819C0000.00000004.mdmp, 00000000-00001212.00000002.198921.81AD0000.00000004.mdmp, Indicator: "inserted into this container.")33:T5b99,Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetOEMCP"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FlsSetValue"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WriteFile"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FindNextFileW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateFileW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetLastError"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TerminateProcess"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetStdHandle"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LocalFree"; File: "joyn_downloader.exe") Found reference to API (Indicator: "K32EnumProcessModules"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetLastError"; File: "joyn_downloader.exe") Found reference to API (Indicator: "EncodePointer"; File: "joyn_downloader.exe") Found reference to API (Indicator: "HeapSize"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "joyn_downloader.exe") Found reference to API (Indicator: "Sleep"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "HeapFree"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetConsoleWindow"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReadFile"; File: "joyn_downloader.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FindClose"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ExitProcess"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFileType"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FreeLibrary"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "VirtualProtect"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DeleteFileW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FlsGetValue"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateProcessW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "joyn_downloader.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetTempPathW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FormatMessageW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetStdHandle"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FlsAlloc"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetErrorMode"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CompareStringW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCPInfo"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetACP"; File: "joyn_downloader.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FlsFree"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "joyn_downloader.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CloseHandle"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RaiseException"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetProcAddress"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "HeapAlloc"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LCMapStringW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "joyn_downloader.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DestroyWindow"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ShowWindow"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "PeekMessageW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RegisterClassW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetCursorPos"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TranslateMessage"; File: "joyn_downloader.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CompareStringEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LoadLibrary"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateDirectory"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReportEventW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "VirtualFree"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TlsSetValue"; File: "joyn_downloader.exe") Found reference to API (Indicator: "VirtualLock"; File: "joyn_downloader.exe") Found reference to API (Indicator: "FormatMessageA"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CreateFiberEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "joyn_downloader.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DeleteFiber"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "joyn_downloader.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "joyn_downloader.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "joyn_downloader.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetSystemTime"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ConvertThreadToFiberEx"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TlsAlloc"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TlsFree"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "joyn_downloader.exe") Found reference to API (Indicator: "TlsGetValue"; File: "joyn_downloader.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "joyn_downloader.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "MessageBoxW"; File: "joyn_downloader.exe") Found reference to API (Indicator: "getsockopt"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WSAStartup"; File: "joyn_downloader.exe") Found reference to API (Indicator: "gethostbyname"; File: "joyn_downloader.exe") Found reference to API (Indicator: "inet_addr"; File: "joyn_downloader.exe") Found reference to API (Indicator: "recvfrom"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "joyn_downloader.exe") Found reference to API (Indicator: "getservbyport"; File: "joyn_downloader.exe") Found reference to API (Indicator: "getservbyname"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ioctlsocket"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WSACleanup"; File: "joyn_downloader.exe") Found reference to API (Indicator: "getsockname"; File: "joyn_downloader.exe") Found reference to API (Indicator: "inet_ntoa"; File: "joyn_downloader.exe") Found reference to API (Indicator: "closesocket"; File: "joyn_downloader.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "joyn_downloader.exe") Found reference to API (Indicator: "WSASetLastError"; File: "joyn_downloader.exe") Found reference to API (Indicator: "ntohs"; File: "joyn_downloader.exe") Found reference to API (Indicator: "htons"; File: "joyn_downloader.exe") Found reference to API (Indicator: "htonl"; File: "joyn_downloader.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "joyn_downloader.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "joyn_downloader.exe") Found reference to API (Indicator: "RtlUnwind"; File: "joyn_downloader.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "joyn_downloader.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A2A25000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.98142000.00000002.mdmp, 00000000-00001212.00000000.195936.A1833000.00000002.mdmp, 00000000-00001212.00000000.195936.A18A4000.00000002.mdmp, 00000000-00001212.00000000.195936.A2A25000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.9E45D000.00000002.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp, 00000000-00001212.00000001.197856.FFB00000.00000004.mdmp, 00000000-00001212.00000002.198921.FFB00000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A18A4000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A2A16000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A2A25000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A18A4000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.A18A4000.00000002.mdmp, 00000000-00001212.00000000.195936.A2A16000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found reference to API (Indicator: "gethostname"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "recvfrom"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp, 00000000-00001212.00000002.198921.81354000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp")34:T4fd,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "joyn_downloader.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "joyn_downloader.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "joyn_downloader.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "joyn_downloader.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001212.00000000.195936.6500E000.00000004.mdmp, 00000000-00001212.00000000.195936.98142000.00000002.mdmp, 00000000-00001212.00000000.195936.A1833000.00000002.mdmp, 00000000-00001212.00000000.195936.A18A4000.00000002.mdmp, 00000000-00001212.00000000.195936.A2A25000.00000002.mdmp, 00000000-00001212.00000001.197856.65012000.00000002.mdmp, 00000000-00001212.00000001.197856.8BF4F000.00000002.mdmp, 00000000-00001212.00000001.197856.92392000.00000002.mdmp, 00000000-00001212.00000001.197856.938A4000.00000002.mdmp, 00000000-00001212.00000001.197856.9E45D000.00000002.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000001.197856.A30C4000.00000002.mdmp, 00000000-00001212.00000001.197856.FFB00000.00000004.mdmp, 00000000-00001212.00000002.198921.FFB00000.00000004.mdmp")35:T903,"libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-3.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-3.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-3.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-3.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-3.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-3.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-3.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-3.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-3.dll" contains export function called "AES_decrypt" at ordinal 2536:Tb07,Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "cacert.pem" as clean (type is "Unknown"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "VCRUNTIME140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-math-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-file-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-convert-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-string-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-runtime-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-profile-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-file-l1-2-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-errorhandling-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-heap-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-synch-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-sysinfo-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-timezone-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections")37:T10e2,"joyn_downloader.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-math-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-file-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-convert-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-stdio-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-runtime-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-profile-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-file-l1-2-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-errorhandling-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-heap-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-synch-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-sysinfo-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-timezone-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-rtlsupport-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-locale-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-debug-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF38:T6f7,";Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000000.195936.81354000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001212.00000001.197856.809E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000001.197856.80BE0000.00000004.mdmp ";Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000001.197856.81354000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000001.197856.81DF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001212.00000001.197856.FFA00000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001212.00000001.197856.FFA00000.00000004.mdmp "achine\Software\Classes\@" in Source: 00000000-00001212.00000002.198921.80851000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001212.00000002.198921.809E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000002.198921.80BE0000.00000004.mdmp ";Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000002.198921.81382000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001212.00000002.198921.81DF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001212.00000002.198921.FFA00000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001212.00000002.198921.FFA00000.00000004.mdmp39:T139d,"joyn_downloader.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa9f180000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffab7700000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffab7700000 "joyn_downloader.exe" loaded module "RPCRT4.DLL" at base 7ffab8620000 "joyn_downloader.exe" loaded module "VCRUNTIME140.DLL" at base 7ffaaf010000 "joyn_downloader.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ffaae0f0000 "joyn_downloader.exe" loaded module "NTDLL.DLL" at base 7ffaba9e0000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffab53b0000 "joyn_downloader.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffab6d70000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffab7700000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffab7700000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\UCRTBASE.DLL" at base 7ffa937e0000 "joyn_downloader.exe" loaded module "KERNELBASE.DLL" at base 7ffab7700000 "joyn_downloader.exe" loaded module "KERNEL32.DLL" at base 7ffaba900000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\PYTHON313.DLL" at base 7ffa923e0000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffab7970000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffab7700000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\PYTHON3" at base 1c0ff5e0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_CTYPES.PYD" at base 7ffaa1820000 "joyn_downloader.exe" loaded module "KERNEL32" at base 7ffaba900000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_BZ2.PYD" at base 7ffaa1970000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_LZMA.PYD" at base 7ffaa0660000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_QUEUE.PYD" at base 7ffaa2a00000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_WMI.PYD" at base 7ffaa18a0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_HASHLIB.PYD" at base 7ffa9e880000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_SOCKET.PYD" at base 7ffa9e480000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\SELECT.PYD" at base 7ffaa1890000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_SSL.PYD" at base 7ffa9e450000 "joyn_downloader.exe" loaded module "OLE32.DLL" at base 7ffab84d0000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffab7700000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffaad1c0000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffaab9a0000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffab7700000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffab7700000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffaa9e20000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_UUID.PYD" at base 7ffaa0fd0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\UTIL\_CPUID_C.PYD" at base 7ffa9f170000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\CIPHER\_RAW_AES.PYD" at base 7ffa9e440000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\CIPHER\_RAW_AESNI.PYD" at base 7ffa9e410000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\UTIL\_STRXOR.PYD" at base 7ffa9e400000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\HASH\_SHA1.PYD" at base 7ffa9e230000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\CIPHER\_PKCS1_DECODE.PYD" at base 7ffa9e220000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\HASH\_BLAKE2S.PYD" at base 7ffa9bbc0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\HASH\_SHA256.PYD" at base 7ffa9bbb0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CRYPTO\MATH\_MODEXP.PYD" at base 7ffa9bba0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\GOOGLE\_UPB\_MESSAGE.PYD" at base 64fc0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\_ELEMENTTREE.PYD" at base 7ffa9bb70000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\PYEXPAT.PYD" at base 7ffa978d0000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffab65c0000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\CHARSET_NORMALIZER\CD.CP313-WIN_AMD64.PYD" at base 7ffa9bb10000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\ADA92CB5D92A588D1B93__MYPYC.CP313-WIN_AMD64.PYD" at base 7ffa96350000 "joyn_downloader.exe" loaded module "%TEMP%\_MEI3842\UNICODEDATA.PYD" at base 7ffa93af0000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffaaf720000 "joyn_downloader.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffaafdf0000 "joyn_downloader.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffab77000003a:Tfa8,"joyn_downloader.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "joyn_downloader.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-profile-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-profile-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-file-l1-2-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-file-l1-2-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-heap-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-heap-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-timezone-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-timezone-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-rtlsupport-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-rtlsupport-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-debug-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-debug-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker"3b:T77b,"joyn_downloader.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-math-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-file-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-convert-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-stdio-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-string-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-runtime-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-profile-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-file-l1-2-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-errorhandling-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-heap-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-synch-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-sysinfo-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-timezone-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-rtlsupport-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-locale-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-debug-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"3c:T610,"joyn_downloader.exe" has an writable section named ".data" "joyn_downloader.exe" has an writable section named ".fptable" "libcrypto-3.dll" has an writable section named ".data" "libssl-3.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "api-ms-win-crt-math-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-file-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-convert-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-stdio-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-string-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-runtime-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-profile-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-file-l1-2-0.dll" has an writable section named ".data" "api-ms-win-core-errorhandling-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-heap-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-synch-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-sysinfo-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-timezone-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-rtlsupport-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-locale-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-debug-l1-1-0.dll" has an writable section named ".data"3d:T15c7,"joyn_downloader.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000d950,add rsp, 0x28,jmp 0x14000d540,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000df10,test eax, eax,je 0x14000d719,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],xor eax, eax,lock cmpxchg qword ptr [rip + 0x396bb], rcx,je 0x14000d719,cmp rcx, rax,je 0x14000d720,xor eax, eax,lock cmpxchg qword ptr [rip + 0x396a9], rcx,jne 0x14000d707,xor al, al,add rsp, 0x28,ret ,mov al, 1," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x18036e880,jmp 0x1801ecaa0,jmp 0x18018f700,jmp 0x18021d7e0,jmp 0x1802ea1b0,jmp 0x1802bb3c0,jmp 0x18029d950,jmp 0x180284f00,jmp 0x1800b3110,jmp 0x1802ee6b0,jmp 0x180272780,jmp 0x180246710,jmp 0x18022c5b0,jmp 0x18022daf0,jmp 0x18035f340,jmp 0x1800ef850,jmp 0x180296050,jmp 0x18019acb0,jmp 0x1801ebe10,jmp 0x18020fb30," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x18007ec0c,jmp 0x18001e4b0,jmp 0x180024060,jmp 0x1800096a0,jmp 0x180065980,jmp 0x18002fa60,jmp 0x18007f5f0,jmp 0x180074dc0,jmp 0x1800123b0,jmp 0x180029150,jmp 0x180037ea0,jmp 0x18002d4e0,jmp 0x18001b800,jmp 0x180051e10,jmp 0x180024f20,jmp 0x1800662d0,jmp 0x18006e620,jmp 0x180013e00,jmp 0x18007f700,jmp 0x180054090," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "api-ms-win-crt-math-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-file-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-convert-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-stdio-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-string-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-runtime-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-profile-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-file-l1-2-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-errorhandling-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-heap-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-synch-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-sysinfo-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-timezone-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-rtlsupport-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-locale-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-debug-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al,"3e:T5ad,"joyn_downloader.exe" has high imagebase "0x140000000" "libcrypto-3.dll" has high imagebase "0x180000000" "libssl-3.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "python3.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "api-ms-win-crt-math-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-file-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-convert-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-stdio-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-string-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-runtime-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-profile-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-file-l1-2-0.dll" has high imagebase "0x180000000" "api-ms-win-core-errorhandling-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-heap-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-synch-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-sysinfo-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-timezone-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-rtlsupport-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-locale-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-debug-l1-1-0.dll" has high imagebase "0x180000000"3f:T502f,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI3842\python313.dll]- [targetUID: 00000000-00001212] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libcrypto-3.dll]- [targetUID: 00000000-00001212] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libssl-3.dll]- [targetUID: 00000000-00001212] "cacert.pem" has type "Unknown"- Location: [%TEMP%\_MEI3842\certifi\cacert.pem]- [targetUID: 00000000-00000384] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140.dll]- [targetUID: 00000000-00001212] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI3842\python3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00001212] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 12144 method=store"- Location: [%TEMP%\_MEI3842\base_library.zip]- [targetUID: 00000000-00001212] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00000384] "_message.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 19 sections"- Location: [%TEMP%\_MEI3842\google\_upb\_message.pyd]- [targetUID: 00000000-00001212] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\unicodedata.pyd]- [targetUID: 00000000-00001212] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_decimal.pyd]- [targetUID: 00000000-00001212] "ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd]- [targetUID: 00000000-00001212] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\pyexpat.pyd]- [targetUID: 00000000-00001212] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_ssl.pyd]- [targetUID: 00000000-00001212] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_lzma.pyd]- [targetUID: 00000000-00001212] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_elementtree.pyd]- [targetUID: 00000000-00001212] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_ctypes.pyd]- [targetUID: 00000000-00001212] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_socket.pyd]- [targetUID: 00000000-00001212] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_bz2.pyd]- [targetUID: 00000000-00001212] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00000384] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_asyncio.pyd]- [targetUID: 00000000-00001212] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_hashlib.pyd]- [targetUID: 00000000-00001212] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00000384] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_overlapped.pyd]- [targetUID: 00000000-00001212] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00000384] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00000384] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_wmi.pyd]- [targetUID: 00000000-00001212] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_multiprocessing.pyd]- [targetUID: 00000000-00001212] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00001212] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_queue.pyd]- [targetUID: 00000000-00001212] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\select.pyd]- [targetUID: 00000000-00001212] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00001212] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_uuid.pyd]- [targetUID: 00000000-00001212] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00000384] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00000384] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00000384] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00000384] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00000384] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00001212] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00000384] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00000384] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00000384] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00001212] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00000384] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00000384] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00001212] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00000384] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00000384] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00000384] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00000384] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00000384] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00001212] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00000384] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00000384] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00000384] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00000384] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00000384] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00001212] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00000384] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00000384] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00000384] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00000384] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00000384] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00000384] "md.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\charset_normalizer\md.cp313-win_amd64.pyd]- [targetUID: 00000000-00000384] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00000384] "cd.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\charset_normalizer\cd.cp313-win_amd64.pyd]- [targetUID: 00000000-00001212] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00000384] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00001212] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00001212] "device.wvd" has type "Unknown"- Location: [%TEMP%\_MEI3842\device.wvd]- [targetUID: 00000000-00001212] "sslkey.txt" has type "Unknown"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00001212] "Lorem ipsum.txt" has type "Unknown"- Location: [%TEMP%\_MEI3842\setuptools\_vendor\jaraco\text\Lorem ipsum.txt]- [targetUID: 00000000-00001212]40:T757,"joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")41:T131d,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI3842\python313.dll]- [targetUID: 00000000-00001212] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libcrypto-3.dll]- [targetUID: 00000000-00001212] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libssl-3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140.dll]- [targetUID: 00000000-00001212] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI3842\python3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001212]42:Tbd4,"joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "JOYN_DOWNLOADER"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "")43:Tc83,"joyn_downloader.exe" trying to access non-existent file "C:\FLTLIB.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\MSVCP140.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\VCRUNTIME140.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\VCRUNTIME140_1.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-DATETIME-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-DEBUG-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-FIBERS-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-FILE-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-FILE-L1-2-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-FILE-L2-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-HEAP-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-MEMORY-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL"44:Tcb4,"joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\CRYPTO" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\CIPHER" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_SALSA20.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_CHACHA20.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_PKCS1_DECODE.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_AES.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_AESNI.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_ARC2.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_BLOWFISH.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_CAST.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_CBC.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_CFB.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_CTR.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_DES.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_DES3.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_ECB.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_EKSBLOWFISH.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_OCB.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_RAW_OFB.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\HASH" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_BLAKE2S.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD2.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD4.PYD" "joyn_downloader.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD5.PYD"45:T692,Found string "cryptsetup-openssl-exception" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "cryptsetup-OpenSSL-exception" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "openvpn-openssl-exception" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "vsftpd-openssl-exception" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "x11vnc-openssl-exception" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "openssl-standalone" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "OpenSSL-standalone" (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found string "This happens to urllib3 injected with pyOpenSSL-backed SSL-support." (Indicator: "openssl-"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000001.197856.81AD0000.00000004.mdmp, 00000000-00001212.00000002.198921.812E7000.00000004.mdmp, 00000000-00001212.00000002.198921.81AD0000.00000004.mdmp")46:T15fc,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "joyn_downloader.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "joyn_downloader.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "joyn_downloader.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "joyn_downloader.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "joyn_downloader.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "joyn_downloader.exe") Found reference to API "# How to send help() to stderr" (Indicator: " send "; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found reference to API "Utility function to accept strings in functions that otherwise" (Indicator: " accept "; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found reference to API "This combines the connect and read timeouts into one; the read timeout" (Indicator: " connect "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "will be set to the time leftover from the connect attempt. In the" (Indicator: " connect "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "event that both a connect timeout and a total are specified, or a read" (Indicator: " connect "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "read operations on the socket connecting the client and the server," (Indicator: " socket "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "*reuse_port* dictates whether to use the SO_REUSEPORT socket option." (Indicator: " socket "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " socket "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " accept "; Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp, 00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found reference to API "the raw I/O interface on top of a socket object." (Indicator: " socket "; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.80BE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found reference to API "cannot accept context and kwargs" (Indicator: " accept "; Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found reference to API "list. We also accept a phrase that starts with CFWS followed by a dot;" (Indicator: " accept "; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found reference to API "object to send in the body of the :class:`Request`." (Indicator: " send "; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000001.197856.81BD0000.00000004.mdmp, 00000000-00001212.00000001.197856.81DF0000.00000004.mdmp, 00000000-00001212.00000002.198921.81BD0000.00000004.mdmp, 00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found reference to API ":param json: (optional) A JSON serializable Python object to send in the body of the :class:`Request`." (Indicator: " send "; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000001.197856.81BD0000.00000004.mdmp, 00000000-00001212.00000001.197856.81DF0000.00000004.mdmp, 00000000-00001212.00000002.198921.81BD0000.00000004.mdmp, 00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found reference to API ":param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`." (Indicator: " send "; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found reference to API ":param cookies: (optional) Dict or CookieJar object to send with the :class:`Request`." (Indicator: " send "; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found reference to API ":param timeout: (optional) How many seconds to wait for the server to send data" (Indicator: " send "; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp")47:T413,Potential IP "192.0.2.0" found in string "addr1 = ip_network('192.0.2.0/28')" Potential IP "192.0.2.1" found in string "addr2 = ip_network('192.0.2.1/32')" Potential IPs "192.0.2.0" "192.0.2.2" found in string "[IPv4Network('192.0.2.0/32'), IPv4Network('192.0.2.2/31')," Potential IPs "192.0.2.4" "192.0.2.8" found in string "IPv4Network('192.0.2.4/30'), IPv4Network('192.0.2.8/29')]" Potential IP "1.2.3.0" found in string ">>> Specifier("==1.2.3") == Specifier("== 1.2.3.0")" Potential IP "4.2.3.1" found in string "4.2.3.1 a label must not start or end with a hyphen" Potential IPs "192.168.1.1" "192.168.1.0" found in string "192.168.1.1 and net = 192.168.1.0/24" Potential IPs "192.168.1.1" "192.168.100.0" found in string "returns False if ip = 192.168.1.1 and net = 192.168.100.0/24" Potential IP "255.255.255.0" found in string "Example: if mask is 24 function returns 255.255.255.0" Potential IPs "192.168.1.1" "192.168.1.0" found in string "Example: returns True if ip = 192.168.1.1 and net = 192.168.1.0/24" "0.0.0.0"48:T603d,Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "yu5a0.dj" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "www.memtest86.com" Heuristic match: "auth.joyn.de" Pattern match: "https://developers.google.com/protocol-buffers/docs/news/2022-05-06#python-updates" Pattern match: "z-google.golang.org/protobuf/types/descriptorpb" Heuristic match: "thread.name" Heuristic match: "warnings.py" Heuristic match: "f _weakrefset.py" Heuristic match: "contextlib.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\util.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\_opcode_metadata.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\__init__.py" Heuristic match: "bc:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\machinery.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\_bootstrap.py" Heuristic match: "inspect.py" Heuristic match: "ast.py" Heuristic match: "parameter.name" Heuristic match: "dis.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\dis.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\opcode.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\token.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\_bootstrap_external.py" Heuristic match: "bytecode.info" Heuristic match: "opcode.py" Heuristic match: "ata.py" Pattern match: "https://github.com/python/importlib_metadata/wiki/development-methodology" Heuristic match: "_opcode_metadata.py" Heuristic match: "linecache.py" Heuristic match: "importlib\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\tokenize.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\zipfile\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\_abc.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pathlib\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\zipfile\_path\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pathlib\_abc.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pathlib\_local.py" Heuristic match: "__.py" Heuristic match: "tokenize.py" Heuristic match: "filename.py" Heuristic match: "token.py" Pattern match: "https://peps.python.org/pep-0205/" Pattern match: "https://example.com/" Heuristic match: "timeout in socket.py" Pattern match: "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py#l535" Heuristic match: "global default timeout in socket.py" Pattern match: "tf.org/rfc/rfc1421.txt" Pattern match: "http://www.ietf.org/rfc/rfc1423.txt" Pattern match: "http://www.ietf.org/rfc/rfc3447.txt" Pattern match: "http://www.ietf.org/rfc/rfc5208.txt" Heuristic match: "platform.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\platform.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\sysconfig\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\email\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\utils.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\tags.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\_manylinux.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\_elffile.py" Heuristic match: "java.vm.name" Heuristic match: "setuptools\_distutils\archive_util.py" Heuristic match: "setuptools\_distutils\util.py" Heuristic match: "setuptools\_distutils\_log.py" Heuristic match: "setuptools\_distutils\dir_util.py" Heuristic match: "setuptools\_distutils\spawn.py" Heuristic match: "setuptools\_distutils\file_util.py" Heuristic match: "setuptools\_distutils\debug.py" Heuristic match: "setuptools\_distutils\dist.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\archive_util.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\_log.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\dir_util.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\file_util.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\spawn.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\util.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\debug.py" Heuristic match: "sysconfig\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pkgutil.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\getopt.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\gettext.py" Heuristic match: "pyi_rth_multiprocessing.py" Pattern match: "https://github.com/pypa/packaging" Pattern match: "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html" Heuristic match: "pyi_rth_pkgutil.py" Heuristic match: "email\__init__.py" Heuristic match: "donald@stufft.io" Heuristic match: "packaging\__init__.py" Heuristic match: "packaging\utils.py" Heuristic match: "packaging\tags.py" Pattern match: "https://github.com/pypa/setuptools/issues/1024" Heuristic match: "inux.py" Heuristic match: "packaging\_manylinux.py" Heuristic match: "le.py" Heuristic match: "packaging\_elffile.py" Heuristic match: "setuptools\_distutils\fancy_getopt.py" Heuristic match: "pt.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\_musllinux.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\version.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\logging.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\monkey.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\depends.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_imp.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\discovery.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_path.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\dist.py" Heuristic match: "packaging\_musllinux.py" Heuristic match: "packaging\version.py" Pattern match: "https://peps.python.org/pep-0639/" Pattern match: "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\fancy_getopt.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\extension.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\filelist.py" Pattern match: "https://bugs.python.org/issue44497" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\log.py" Heuristic match: "getopt.py" Heuristic match: "gettext.py" Heuristic match: "nulltranslations.info" Heuristic match: "setuptools\monkey.py" Heuristic match: "%s.mo" Heuristic match: "setuptools\_distutils\extension.py" Heuristic match: "setuptools\_distutils\filelist.py" Heuristic match: "setuptools\_distutils\log.py" Pattern match: "https://github.com/pypa/setuptools/discussions/5011" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\numbers.py" Heuristic match: "setuptools\depends.py" Heuristic match: "setuptools\_imp.py" Heuristic match: "__init__.py" Heuristic match: "setuptools\discovery.py" Heuristic match: "setuptools\_path.py" Heuristic match: "setuptools\dist.py" Pattern match: "https://packaging.python.org/en/latest/" Heuristic match: "warning: %r not a valid package name; please use only .-separated package names in setup.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_vendor\jaraco\context\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\markers.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\_parser.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\_tokenizer.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\dataclasses.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\specifiers.py" Heuristic match: "numbers.py" Heuristic match: "packaging\markers.py" Heuristic match: "urllib\error.py" Heuristic match: "urllib\response.py" Heuristic match: "addinfo.info" Heuristic match: "nturl2path.py" Heuristic match: "tarfile.py" Heuristic match: "gnu.sparse.name" Heuristic match: "importlib\resources\_adapters.py" Heuristic match: "compatibilityfiles.specpath.name" Heuristic match: "compatibilityfiles.childpath.name" Heuristic match: "compatibilityfiles.orphanpath.name" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\resources\_adapters.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\metadata\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\metadata\_meta.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\metadata\_collections.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\metadata\_functools.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\importlib\metadata\_itertools.py" Pattern match: "https://pypi.org/project/build/" Heuristic match: "setuptools\_importlib.py" Heuristic match: "importlib\metadata\__init__.py" Heuristic match: "packagenotfounderror.name" Heuristic match: "setuptools\_itertools.py" Heuristic match: "importlib\metadata\_meta.py" Heuristic match: "distribution.at" Heuristic match: "distribution.name" Heuristic match: "json\__init__.py" Pattern match: "https://tools.ietf.org/html/rfc8017" Heuristic match: "json\decoder.py" Heuristic match: "json\scanner.py" Heuristic match: "json\encoder.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_itertools.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\errors.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_reqs.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\requirements.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_static.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\warnings.py" Heuristic match: "dx.py" Heuristic match: "and.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\configparser.py" Heuristic match: "setuptools\errors.py" Heuristic match: "setuptools\_reqs.py" Heuristic match: "importlib\metadata\_collections.py" Heuristic match: "importlib\metadata\_functools.py" Heuristic match: "importlib\metadata\_itertools.py" Heuristic match: "packaging\requirements.py" Pattern match: "https://setuptools.pypa.io/en/latest/" Heuristic match: "setuptools\command\__init__.py" Heuristic match: "setuptools\_distutils\command\bdist.py" Heuristic match: "ist.py" Heuristic match: "setuptools\_normalization.py" Heuristic match: "packaging\licenses\__init__.py" Heuristic match: "packaging\licenses\_spdx.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_normalization.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\command\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\command\bdist.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\command\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\config\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\licenses\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\packaging\licenses\_spdx.py" Heuristic match: "setuptools\_static.py" Heuristic match: "setuptools\warnings.py" Heuristic match: "setuptools\_distutils\command\__init__.py" Heuristic match: "setuptools\config\_apply_pyprojecttoml.py" Heuristic match: "setuptools\config\__init__.py" Heuristic match: "setuptools\config\setupcfg.py" Heuristic match: "f}.ge" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\config\setupcfg.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\config\expand.py" Pattern match: "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/" Heuristic match: "setuptools\config\expand.py" Heuristic match: "configparser.py" Heuristic match: "setuptools\config\pyprojecttoml.py" Heuristic match: "sectionproxy.name" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\email\headerregistry.py" Heuristic match: "parser.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\extension.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\version.py" Heuristic match: "ing.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\config\pyprojecttoml.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\config\_apply_pyprojecttoml.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\email\_header_value_parser.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\__init__.py" Heuristic match: "email\_header_value_parser.py" Heuristic match: "email\headerregistry.py" Heuristic match: "baseheader.name" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\context.py" Heuristic match: "cess.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\process.py" Heuristic match: "uction.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\joyn_downloader.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\_compat_pickle.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\spawn.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\util.py" Heuristic match: "setuptools\extension.py" Heuristic match: "setuptools\_core_metadata.py" Pattern match: "https://peps.python.org/pep-0685/" Heuristic match: "setuptools\version.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_core_metadata.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\multiprocessing\reduction.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\crypto\publickey\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\crypto\util\_cpu_features.py" Pattern match: "https://packaging.python.org/en/latest/specifications/core-metadata/" Pattern match: "https://en.wikipedia.org/wiki/sic" Heuristic match: "pkgutil.py" Heuristic match: "multiprocessing\__init__.py" Heuristic match: "multiprocessing\context.py" Heuristic match: "multiprocessing\process.py" Heuristic match: "multiprocessing\spawn.py" Heuristic match: "multiprocessing\reduction.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pickle.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\runpy.py" Pattern match: "https://entitlement.p7s1.io/api/user/entitlement-token" Heuristic match: "baseprocess.name" Heuristic match: "pickle.py" Pattern match: "https://github.com/ousret/charset_normalizer" Pattern match: "http://www.ietf.org/rfc/rfc1421.txt" Heuristic match: "basehttpresponse.info" Pattern match: "http://www.w3.org/xml/1998/namespace}space" Heuristic match: "ctypes\wintypes.py" Heuristic match: "requests\structures.py" Pattern match: "https://httpbin.org/get" Heuristic match: "6cookiejar that can be loaded from and saved to a file.nc" Pattern match: "https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy" Heuristic match: "idna\core.py" Heuristic match: "urllib3\response.py" Pattern match: "http://wwwsearch.sf.net/" Heuristic match: "socks.py" Heuristic match: "4socket_err contains original socket.error exception.nc" Heuristic match: "like socket.cr" Pattern match: "https://docs.python.org/3/library/socket.html#socket.socket.connect_ex" Pattern match: "https://ro" Heuristic match: "prepares the given http auth data.nr" Heuristic match: "requests\utils.py" Heuristic match: "uconverts mask from /xx format to xxx.xxx.xxx.xxx" Pattern match: "http://.../back.jpeg" Heuristic match: "crypto\math\primality.py" Heuristic match: "crypto\math\_integergmp.py" Heuristic match: "crypto\math\_integerbase.py" Heuristic match: "crypto\math\_integercustom.py" Heuristic match: "crypto\math\_integernative.py" Heuristic match: "google\protobuf\__init__.py" Heuristic match: "google\protobuf\message.py" Heuristic match: "crypto\random\random.py" Pattern match: "https://github.com/construct/construct" Pattern match: "http://construct.readthedocs.org" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\crypto\random\random.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pywidevine\device.py" Heuristic match: "tem.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\core.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\expr.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\debug.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\container.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\py3compat.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\binary.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\bitstream.py" Heuristic match: "%?.gf" Heuristic match: "pywidevine\device.py" Heuristic match: "construct\__init__.py" Heuristic match: "construct\core.py" Heuristic match: "construct\lib\__init__.py" Heuristic match: "construct\lib\container.py" Heuristic match: "construct\expr.py" Heuristic match: "construct\lib\py3compat.py" Heuristic match: "reflection_test.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\lib\hex.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\construct\version.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\rlcompleter.py" Heuristic match: "iptor.py" Heuristic match: "nary.py" Heuristic match: "construct\lib\binary.py" Heuristic match: "construct\lib\hex.py" Heuristic match: "construct\lib\bitstream.py" Heuristic match: "hex.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\cmd.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\bdb.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\code.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pprint.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\codeop.py" Heuristic match: "construct\debug.py" Heuristic match: "pdb.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\pywidevine\license_protocol_pb2.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\descriptor.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\descriptor_pool.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\__init__.py" Heuristic match: "cmd.py" Heuristic match: "bdb.py" Heuristic match: "code.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\api_implementation.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\enum_type_wrapper.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\python_edition_defaults.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\message_listener.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\google\protobuf\internal\well_known_types.py" Heuristic match: "codeop.py" Heuristic match: "pprint.py" Heuristic match: "%?.gd" Heuristic match: "converts mask from /xx format to xxx.xxx.xxx.xxx" Heuristic match: "certifi.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\_internal_utils.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\urllib3\contrib\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\certifi\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\certifi\core.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\__version__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\_types.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\cookies.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\structures.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\api.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\sessions.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\adapters.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\auth.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\models.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\stringprep.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\hooks.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\requests\status_codes.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\urllib3\contrib\socks.py" Heuristic match: "requests\_internal_utils.py" Heuristic match: "requests\_types.py" Heuristic match: "requests\cookies.py" Heuristic match: "mockresponse.info" Heuristic match: "requests\sessions.py" Heuristic match: "requests\adapters.py" Pattern match: "https://github.com/psf/requests/pull/6710" Heuristic match: "requests\auth.py" Heuristic match: "requests\models.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\socks.py" Heuristic match: "encodings\idna.py" Heuristic match: "na.py" Heuristic match: "stringprep.py" Heuristic match: "requests\hooks.py" Heuristic match: "requests\status_codes.py" Heuristic match: "urllib3\contrib\__init__.py" Heuristic match: "urllib3\contrib\socks.py" Heuristic match: "colorama\initialise.py" Heuristic match: "colorama\ansitowin32.py" Heuristic match: "colorama\ansi.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\__init__.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\initialise.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\ansitowin32.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\ansi.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\winterm.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\colorama\win32.py" Heuristic match: "c:\users\njlfwdy\appdata\local\temp\_mei3842\ctypes\wintypes.py" Heuristic match: "colorama\winterm.py" Heuristic match: "colorama\win32.py" Heuristic match: "es.py" Pattern match: "http://www.w3.org/xml/1998/namespace"49:T8fed,Found URL "https://developers.google.com/protocol-buffers/docs/news/2022-05-06" - Source: "00000000-00001212.00000000.195936.64FFB000.00000002.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/" - Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1423.txt.." - Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc3447.txt.." - Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc5208.txtopensshrssh-rsaressh-rsa" - Source: "00000000-00001212.00000000.195936.805E0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingdistributionmetadata.get_obsoletesk" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlb" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.a" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\log.pygiven" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/discussions/5011distribution._skip_setupcfg_normalizationadd" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.sort_tuplefilelist.sortremove_duplicatesglobal-includeglobal-excluderecursive-includerecursive-excludeunknown" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_filessetuptools._entry_pointsdistribution._expand_patternsspecifications/glob-patterns/please" - Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017>" - Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptools_enforce_deprecationsetuptools\command\__init__.pysetuptools.config.pyprojecttomllist" - Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001212.00000000.195936.80DE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/_ambiguousmarker.messageuserguide/declarative_config.htmldistribution" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/l.wstool_table_correspondence_reset_previously_defined" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/jun" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/returns" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)extend_pathwalk_packagesiter_modulesread_code[af" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://entitlement.p7s1.io/api/user/entitlement-tokensing'process" - Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1421.txt.." - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1423.txt.." - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc3447.txt.." - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc5208.txtaduu[uu[/a$uuuc!uusuu[/a" - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/socket.html" - Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp") Found URL "https://ro:" - Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp") Found URL "https://github.com/construct/construct" - Source: "00000000-00001212.00000000.195936.819C0000.00000004.mdmp") Found URL "http://construct.readthedocs.orghands-on" - Source: "00000000-00001212.00000000.195936.819C0000.00000004.mdmp") Found URL "https://streamed" - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "http://." - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "https://session.__enter__nlkqsession.__exit___t.uritypemerged_cookiesprepare_requestsession.prepare_requestsend_kwargs" - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "https://github.com/psf/requests/pull/6710" - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "https://docs.python.org/3/library/socket.html" - Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" - Source: "00000000-00001212.00000000.195936.978F3000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001212.00000000.195936.98142000.00000002.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00001212.00000000.195936.FDCB0000.00000004.mdmp") Found URL "http://google.com/" - Source: "00000000-00001212.00000000.195936.FDCB0000.00000004.mdmp") Found URL "http://httpbin.org/" - Source: "00000000-00001212.00000000.195936.FDCB0000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00001212.00000000.195936.FDCB0000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00001212.00000000.195936.FDCB0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001212.00000000.195936.FFC00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/function_composition>" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/source-distribution-format/" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://developer.android.com/tools/releases/platforms>" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://developer.android.com/ndk/guides/abis>" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://www.numberanalytics.com/blog/ultimate-guide-to-derangements-in-combinatorics*" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://oeis.org/a000166return" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/577916-fast-minmax-function>" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1421.txt.." - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1423.txt.." - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc3447.txt.." - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc5208.txt.." - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "https://flak.tedunangst.com/post/new-openssh-key-format-and-bcrypt-pbkdfa,uu[" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfa" - Source: "00000000-00001212.00000000.195936.FFE00000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001212.00000001.197856.804E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)c:\users\njlfwdy\appdata\local\temp\_mei3842\__future__.pyfor" - Source: "00000000-00001212.00000001.197856.804E0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymldistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001212.00000001.197856.804E0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001212.00000001.197856.804E0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1423.txt.." - Source: "00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc3447.txt.." - Source: "00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc5208.txtopensshrssh-rsaressh-rsa" - Source: "00000000-00001212.00000001.197856.805E0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001212.00000001.197856.809E0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5wrap" - Source: "00000000-00001212.00000001.197856.809E0000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001212.00000001.197856.809E0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.context')>>>" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://retry_https_basic_authdvtdprompt_user_passwdenter" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001212.00000001.197856.80BE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001212.00000001.197856.80CE0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001212.00000001.197856.80CE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001212.00000001.197856.80CE0000.00000004.mdmp") Found URL "https://auth.joyn.de/auth/anonymousafter" - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "https://www.joyn.de" - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "https://api.joyn.de/graphqlupgrade-insecure-sessionget_seasons..no" - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "https://api.vod-prd.s.joyn.de/v1/asset/assetid\\*" - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "https://www.joyn.deaccept-languageuser-agentautoresetlightcyan_exjoyn_downloader.pylightmagenta_exreset_all5.1572.0joyn-client-versionjoyn-countryjoyn-platformjoyn-request-idclient_idclient_nameanon_device_idrgpfwjufaccess_tokenrequest_idclient_idjson_dataguest_token17definvalid_tokensocial_idregisteredpayload_b64ecodevcxfdecoded_bytesget_token_user_type[<>," - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfnput.this" - Source: "00000000-00001212.00000001.197856.810A0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/socket.html" - Source: "00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found URL "https://ro:" - Source: "00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001212.00000001.197856.81AD0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001212.00000001.197856.81BD0000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00001212.00000001.197856.81BD0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/32903\http2teger\utiltoo" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/ansi_escape_codewraps" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "https://requests.readthedocs.iovalidate" - Source: "00000000-00001212.00000001.197856.81DF0000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00001212.00000001.197856.9224B000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001212.00000001.197856.92392000.00000002.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00001212.00000001.197856.FDCB0000.00000004.mdmp") Found URL "http://google.com/" - Source: "00000000-00001212.00000001.197856.FDCB0000.00000004.mdmp") Found URL "http://httpbin.org/" - Source: "00000000-00001212.00000001.197856.FDCB0000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00001212.00000001.197856.FDCB0000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00001212.00000001.197856.FDCB0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001212.00000001.197856.FFA00000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.create" - Source: "00000000-00001212.00000001.197856.FFA00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001212.00000001.197856.FFA00000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001212.00000001.197856.FFC00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/function_composition>" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/source-distribution-format/" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://developer.android.com/tools/releases/platforms>" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://developer.android.com/ndk/guides/abis>" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://www.numberanalytics.com/blog/ultimate-guide-to-derangements-in-combinatorics*" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://oeis.org/a000166return" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/577916-fast-minmax-function>" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1421.txt.." - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc1423.txt.." - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc3447.txt.." - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://www.ietf.org/rfc/rfc5208.txt.." - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://flak.tedunangst.com/post/new-openssh-key-format-and-bcrypt-pbkdfa,uu[" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfa" - Source: "00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/" - Source: "00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)c:\users\njlfwdy\appdata\local\temp\_mei3842\__future__.pyfor" - Source: "00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymldistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/euler%27s_totient_functiona;uuna" - Source: "00000000-00001212.00000002.198921.80679000.00000004.mdmp") Found URL "https://betterexplained.com/articles/intuitive-convolution/*" - Source: "00000000-00001212.00000002.198921.80679000.00000004.mdmp") Found URL "https://www.youtube.com/watch?v=kuxjwb4lzsadsert" - Source: "00000000-00001212.00000002.198921.80679000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001212.00000002.198921.806C2000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001212.00000002.198921.806F4000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfckagreturns" - Source: "00000000-00001212.00000002.198921.807D5000.00000004.mdmp") Found URL "https://developers.google.com/protocol-buffers/docs/encodinghttps://techoverflow.net/blog/2013/01/25/efficiently-encoding-variable-length-integers-in-cc/example::" - Source: "00000000-00001212.00000002.198921.807D5000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001212.00000002.198921.80835000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfchecks" - Source: "00000000-00001212.00000002.198921.80835000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001212.00000002.198921.8083F000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001212.00000002.198921.8083F000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017" - Source: "00000000-00001212.00000002.198921.8083F000.00000004.mdmp") Found URL "https://developers.google.com/protocol-buffers/docs/encodinghttps://techoverflow.net/blog/2013/01/25/efficiently-encoding-variable-length-integers-in-cc/example::" - Source: "00000000-00001212.00000002.198921.80951000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0unless" - Source: "00000000-00001212.00000002.198921.8096D000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001212.00000002.198921.8096D000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00001212.00000002.198921.8096D000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00001212.00000002.198921.8096D000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001212.00000002.198921.809E0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5wrap" - Source: "00000000-00001212.00000002.198921.809E0000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001212.00000002.198921.809E0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingdistributionmetadata.get_obsoletesk" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlb" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.a" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\njlfwdy\appdata\local\temp\_mei3842\setuptools\_distutils\log.py" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/discussions/5011distribution._skip_setupcfg_normalizationadd" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.sort_tuplefilelist.sortremove_duplicatesglobal-includeglobal-excluderecursive-includerecursive-excludeunknown" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_filessetuptools._entry_pointsdistribution._expand_patternsspecifications/glob-patterns/please" - Source: "00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.context')>>>" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://retry_https_basic_authdvtdprompt_user_passwdenter" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001212.00000002.198921.80BE0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001212.00000002.198921.80CE0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001212.00000002.198921.80CE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001212.00000002.198921.80CE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017>" - Source: "00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptools_enforce_deprecationsetuptools\command\__init__.pysetuptools.config.pyprojecttomllist" - Source: "00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001212.00000002.198921.80DE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/_ambiguousmarker.messageuserguide/declarative_config.htmldistribution" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/l.wstool_table_correspondence_reset_previously_defined" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/jun" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/returns" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)extend_pathwalk_packagesiter_modulesread_code[af" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://entitlement.p7s1.io/api/user/entitlement-tokensing'process" - Source: "00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found URL "https://auth.joyn.de/auth/anonymousafter" - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "https://www.joyn.de" - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "https://api.joyn.de/graphqlupgrade-insecure-sessionget_seasons..no" - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "https://api.vod-prd.s.joyn.de/v1/asset/assetid\\*" - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "https://www.joyn.deaccept-languageuser-agentautoresetlightcyan_exjoyn_downloader.pylightmagenta_exreset_all5.1572.0joyn-client-versionjoyn-countryjoyn-platformjoyn-request-idclient_idclient_nameanon_device_idrgpfwjudaccess_tokenrequest_idclient_idjson_dataguest_token17dedinvalid_tokensocial_idregisteredpayload_b64ecodevcxddecoded_bytesget_token_user_type[<>," - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfnput.this" - Source: "00000000-00001212.00000002.198921.810A0000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00001212.00000002.198921.81312000.00000004.mdmp") Found URL "https://docs.python.org/3/library/socket.html" - Source: "00000000-00001212.00000002.198921.81354000.00000004.mdmp") Found URL "https://ro:" - Source: "00000000-00001212.00000002.198921.81382000.00000004.mdmp") Found URL "https://github.com/construct/construct" - Source: "00000000-00001212.00000002.198921.819C0000.00000004.mdmp") Found URL "http://construct.readthedocs.orghands-on" - Source: "00000000-00001212.00000002.198921.819C0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001212.00000002.198921.81AD0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001212.00000002.198921.81BD0000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00001212.00000002.198921.81BD0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/32903\http2teger\utiltoo" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/ansi_escape_code" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "https://requests.readthedocs.iovalidate" - Source: "00000000-00001212.00000002.198921.81DF0000.00000004.mdmp") Found URL "https://streamed" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "http://." - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "https://session.__enter__nlkqsession.__exit___t.uritypemerged_cookiesprepare_requestsession.prepare_requestsend_kwargs" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "https://github.com/psf/requests/pull/6710" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "https://docs.python.org/3/library/socket.html" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "https://auth.joyn.de/auth/anonymousxex" - Source: "00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001212.00000002.198921.93AF6000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespacecdatanotation(http://www.w3.org/2000/xmlns/entityentitieshttp://www.w3.org/xml/1998/namespacenmtokenemptyndatanotationentitypublicidrefspcdatasystemrequirednmtokensdoctypeelementcdataimpliedincludeattlistentitiesidrefignorefixedcdata[" - Source: "00000000-00001212.00000002.198921.9BB85000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001212.00000002.198921.FFA00000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.create" - Source: "00000000-00001212.00000002.198921.FFA00000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001212.00000002.198921.FFA00000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001212.00000002.198921.FFC21000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001212.00000002.198921.FFC21000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001212.00000002.198921.FFC21000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001212.00000002.198921.FFC21000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001212.00000002.198921.FFECD000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc8017" - Source: "00000000-00001212.00000002.198921.FFECD000.00000004.mdmp")4a:Tbcc,"joyn_downloader.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI3842\* (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00000384) "joyn_downloader.exe" called "FindNextFileW" with parameter api-ms-win-core-synch-l1-1-0.dll (UID: 00000000-00000384)4b:T15b9,file/memory contains long string with (Indicator: "aes"; File: "_raw_aes.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_eksblowfish.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_blowfish.pyd") file/memory contains long string with (Indicator: "aes"; File: "_raw_aesni.pyd") file/memory contains long string with (Indicator: "chacha"; File: "_chacha20.pyd") file/memory contains long string with (Indicator: "aes"; File: "_cpuid_c.pyd") Found string "bCrypto\Cipher\_chacha20.pyd" (Indicator: "chacha"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_aes.pyd" (Indicator: "aes"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_aesni.pyd" (Indicator: "aes"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_blowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_eksblowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.FFA00000.00000004.mdmp, 00000000-00001212.00000001.197856.FFB00000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp, 00000000-00001212.00000002.198921.FFA00000.00000004.mdmp, 00000000-00001212.00000002.198921.FFB00000.00000004.mdmp") Found string "a2b_base64" (Indicator: "base64"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\zipfile\_path\__pycache__\__init__.cpython-313.pyc" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\zipfile\_path\__pycache__\glob.cpython-313.pyc" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\zipfile" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "zipfiles that span multiple disks are not supported" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "Is returned by ZipFile.open()." (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found string "Given a source (filename or zipfile), return an" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "ZipFile subclass to ensure implicit" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "A Path-like interface for zipfiles." (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "This codebase is shared between zipfile.Path in the stdlib" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\zipfile\__init__.py" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "Raised when writing a zipfile, the zipfile requires ZIP64 extensions" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000001.197856.804E0000.00000004.mdmp, 00000000-00001212.00000002.198921.804E0000.00000004.mdmp") Found string "C:\Users\njLFwdY\AppData\Local\Temp\_MEI3842\zipfile\_path\__init__.py" (Indicator: "zipfile"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp")4c:T1197,Found string "by namelist(). You can specify the password to decrypt all files" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "Return file bytes for name. 'pwd' is the password to decrypt" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp") Found string "Return (scheme, user, password, host/port) given a URL or an authority." (Indicator: "password"; Source: "00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found string "proxy_password" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found string "password - Password to authenticate with to the server." (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000000.195936.FFE00000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.FFE00000.00000004.mdmp") Found string "PNo username/password supplied. Server requested username/password authenticationrz" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81354000.00000004.mdmp") Found string "username,password." (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found string "passwordr" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp") Found string "- Usernames and passwords for the SOCKS proxy" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp") Found string "When connecting to a SOCKS5 proxy the ``username`` and ``password`` portion" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp") Found string "of the ``proxy_url`` will be sent as the username/password to authenticate" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp") Found string "proxy_url="socks5h://:@proxy-host"" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp") Found string "``ca_cert_dir``, ``ssl_version``, ``key_password`` are only used if :mod:`ssl`" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.819C0000.00000004.mdmp, 00000000-00001212.00000002.198921.819C0000.00000004.mdmp") Found string "No username/password supplied. Server requested username/password authentication" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found string "Non-string passwords will no longer be supported in Requests 3.0.0. Please convert the object you've passed in (" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001212.00000000.195936.929E9000.00000004.mdmp, 00000000-00001212.00000001.197856.9E45D000.00000002.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.9E887000.00000002.mdmp")4d:T431,Found string "route" (Indicator: "route"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found string "obsolete route specification in angle-addr" (Indicator: "route"; Source: "00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp") Found string "either via hostname or fingerprint. This function exists to guarante" (Indicator: "hostname"; Source: "00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000002.198921.812E7000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81DF0000.00000004.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp, 00000000-00001212.00000002.198921.81382000.00000004.mdmp, 00000000-00001212.00000002.198921.81DF0000.00000004.mdmp")4e:T91e,"joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\JOYN_DOWNLOADER.EXE"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "joyn_downloader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T131d,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI3842\python313.dll]- [targetUID: 00000000-00001212] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libcrypto-3.dll]- [targetUID: 00000000-00001212] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libssl-3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140.dll]- [targetUID: 00000000-00001212] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI3842\python3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001212]50:T606,"libcrypto-3.dll" was detected as "Microsoft Visual C++ 8.0" "libssl-3.dll" was detected as "Microsoft Visual C++ 8.0" "python3.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-profile-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-file-l1-2-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-heap-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-timezone-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-rtlsupport-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-debug-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL"51:T4d74,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI3842\python313.dll]- [targetUID: 00000000-00001212] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libcrypto-3.dll]- [targetUID: 00000000-00001212] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\libssl-3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140.dll]- [targetUID: 00000000-00001212] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI3842\python3.dll]- [targetUID: 00000000-00001212] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00001212] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI3842\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00001212] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00000384] "_message.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 19 sections"- Location: [%TEMP%\_MEI3842\google\_upb\_message.pyd]- [targetUID: 00000000-00001212] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\unicodedata.pyd]- [targetUID: 00000000-00001212] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_decimal.pyd]- [targetUID: 00000000-00001212] "ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd]- [targetUID: 00000000-00001212] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\pyexpat.pyd]- [targetUID: 00000000-00001212] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_ssl.pyd]- [targetUID: 00000000-00001212] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_lzma.pyd]- [targetUID: 00000000-00001212] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_elementtree.pyd]- [targetUID: 00000000-00001212] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_ctypes.pyd]- [targetUID: 00000000-00001212] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_socket.pyd]- [targetUID: 00000000-00001212] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_bz2.pyd]- [targetUID: 00000000-00001212] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00000384] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_asyncio.pyd]- [targetUID: 00000000-00001212] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_hashlib.pyd]- [targetUID: 00000000-00001212] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00000384] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_overlapped.pyd]- [targetUID: 00000000-00001212] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00000384] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00000384] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_wmi.pyd]- [targetUID: 00000000-00001212] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_multiprocessing.pyd]- [targetUID: 00000000-00001212] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00001212] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_queue.pyd]- [targetUID: 00000000-00001212] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\select.pyd]- [targetUID: 00000000-00001212] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00001212] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\_uuid.pyd]- [targetUID: 00000000-00001212] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00000384] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00000384] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00000384] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00000384] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00000384] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00001212] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00000384] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00000384] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00000384] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00001212] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00000384] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00000384] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00001212] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00000384] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00000384] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00000384] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00000384] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00000384] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00001212] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00000384] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00000384] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00000384] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00000384] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00000384] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00001212] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00000384] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00000384] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00000384] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00000384] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00000384] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00000384] "md.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\charset_normalizer\md.cp313-win_amd64.pyd]- [targetUID: 00000000-00000384] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00000384] "cd.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\charset_normalizer\cd.cp313-win_amd64.pyd]- [targetUID: 00000000-00001212] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00000384] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00001212] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI3842\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00001212]52:T69c3,"joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\Crypto\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\VCRUNTIME140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_asyncio.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_elementtree.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_multiprocessing.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_overlapped.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_uuid.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\_wmi.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-console-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-debug-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-fibers-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "joyn_downloader.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...53:Tc77,"joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-console-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-debug-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-fibers-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l1-2-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l2-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-handle-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-heap-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-interlocked-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-libraryloader-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-localization-l1-2-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-memory-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-namedpipe-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processenvironment-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processthreads-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processthreads-l1-1-1.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-profile-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-string-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-synch-l1-1-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-synch-l1-2-0.dll" for deletion "joyn_downloader.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll" for deletion54:Td0d,"joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-console-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-datetime-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-debug-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-errorhandling-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-fibers-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l1-2-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-file-l2-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-handle-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-heap-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-interlocked-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-libraryloader-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-localization-l1-2-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-memory-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-namedpipe-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processenvironment-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processthreads-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-processthreads-l1-1-1.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-profile-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-rtlsupport-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-string-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-synch-l1-1-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-synch-l1-2-0.dll" with delete access "joyn_downloader.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI3842\api-ms-win-core-sysinfo-l1-1-0.dll" with delete access55:T6a5,"libcrypto-3.dll" claimed CRC 14151768 while the actual is CRC 5239026 "libssl-3.dll" claimed CRC 5239026 while the actual is CRC 829768 "VCRUNTIME140.dll" claimed CRC 829768 while the actual is CRC 123501 "python3.dll" claimed CRC 123501 while the actual is CRC 88569 "VCRUNTIME140_1.dll" claimed CRC 88569 while the actual is CRC 52724 "api-ms-win-crt-math-l1-1-0.dll" claimed CRC 52724 while the actual is CRC 57066 "api-ms-win-core-file-l1-1-0.dll" claimed CRC 57066 while the actual is CRC 89853 "api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 89853 while the actual is CRC 57293 "api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 57293 while the actual is CRC 44766 "api-ms-win-crt-string-l1-1-0.dll" claimed CRC 44766 while the actual is CRC 81595 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 81595 while the actual is CRC 44370 "api-ms-win-core-profile-l1-1-0.dll" claimed CRC 44370 while the actual is CRC 71499 "api-ms-win-core-file-l1-2-0.dll" claimed CRC 71499 while the actual is CRC 71052 "api-ms-win-core-errorhandling-l1-1-0.dll" claimed CRC 71052 while the actual is CRC 61994 "api-ms-win-core-heap-l1-1-0.dll" claimed CRC 61994 while the actual is CRC 82935 "api-ms-win-core-synch-l1-1-0.dll" claimed CRC 82935 while the actual is CRC 80799 "api-ms-win-core-sysinfo-l1-1-0.dll" claimed CRC 80799 while the actual is CRC 40178 "api-ms-win-core-timezone-l1-1-0.dll" claimed CRC 40178 while the actual is CRC 87350 "api-ms-win-core-rtlsupport-l1-1-0.dll" claimed CRC 87350 while the actual is CRC 78230 "api-ms-win-crt-locale-l1-1-0.dll" claimed CRC 78230 while the actual is CRC 30641 "api-ms-win-core-debug-l1-1-0.dll" claimed CRC 30641 while the actual is CRC 3108356:T584,"VCRUNTIME140.dll" claims program is from Mon Nov 21 08:39:02 2033 "VCRUNTIME140_1.dll" claims program is from Thu Jun 10 23:23:34 1982 "api-ms-win-crt-math-l1-1-0.dll" claims program is from Sun Aug 1 10:51:27 1999 "api-ms-win-core-file-l1-1-0.dll" claims program is from Tue Jun 24 17:19:43 1980 "api-ms-win-crt-convert-l1-1-0.dll" claims program is from Thu Dec 8 01:47:04 2061 "api-ms-win-crt-stdio-l1-1-0.dll" claims program is from Sat Jul 26 09:17:01 2064 "api-ms-win-crt-string-l1-1-0.dll" claims program is from Sat Nov 6 17:48:09 2066 "api-ms-win-crt-runtime-l1-1-0.dll" claims program is from Sat Dec 7 21:11:41 2058 "api-ms-win-core-profile-l1-1-0.dll" claims program is from Sun Sep 9 23:16:13 1973 "api-ms-win-core-file-l1-2-0.dll" claims program is from Fri Jul 6 20:22:10 2040 "api-ms-win-core-errorhandling-l1-1-0.dll" claims program is from Sat Dec 3 19:51:28 2067 "api-ms-win-core-heap-l1-1-0.dll" claims program is from Sat Sep 7 08:08:13 2069 "api-ms-win-core-synch-l1-1-0.dll" claims program is from Sun Oct 16 22:47:14 2101 "api-ms-win-core-sysinfo-l1-1-0.dll" claims program is from Tue Jun 22 16:50:40 2049 "api-ms-win-core-timezone-l1-1-0.dll" claims program is from Tue Oct 27 05:29:21 2065 "api-ms-win-core-rtlsupport-l1-1-0.dll" claims program is from Sun Jul 10 06:57:30 2089 "api-ms-win-crt-locale-l1-1-0.dll" claims program is from Tue Jan 11 05:48:23 209557:T400,AAABAAEAICAQUQAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd4iIdwAAAAAAAAAAAAAAeP////+HAAAAAAAAAAAAB////////3AAAAAAAAAAAA/////////wAAAAAAAAAACP////////+AAAAAAAAAAH///4cAeP//9wAAAAAAAAB///gAAACP//cAAAAAAAAAj//3AAAAf//4AAAAAAAAAI//9wAAAH//+AAAAAAAAACP//cAAAB///gAAAAAAAAAj//3AAAAf//4AAAAAAAAAI//9wAAAH//+AAAAAAAAACP//cAAAB///gAAAAAAAAAj/+HAAAAf//4AAAAAAAAAAAACP//+P//+AAAAAAAAAAAAAj///////gAAAAAAAAAAAAI///////4AAAAAAAAAAAACP//////+AAAAAAAAAAAAAj///////gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1790751700040,"unified_at":"2026-09-30T07:01:40.040Z","metadata":{"hashes":{"sha256":"54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","sha1":"8d2ccc3ec490495045742152507bd69bb56a773a","md5":"9ae1c2afb0e080fe931bb6cf67a6114f","sha512":"272755f87efa536d54cadc1127559935eadb17b9e2511c3e231b10cc538a7a1fc0971cc26f94572860dd20028ffedb11190431bcd25c8d51c7ac657fee9fa7db","ssdeep":"393216:D85vzawvLmcuCnDvV+53SM8+OP8f4AtSDBe9DyIQ:A5vz0CDvV/M8+x4jDBe9Dt","ssdeep_chunks":["393216:D85vzaw","393216:85vzawv","393216:5vzawvL","393216:vzawvLm","393216:zawvLmc","393216:awvLmcu","393216:wvLmcuC","393216:vLmcuCn","393216:LmcuCnD","393216:mcuCnDv","393216:cuCnDvV","393216:uCnDvV+","393216:CnDvV+5","393216:nDvV+53","393216:DvV+53S","393216:vV+53SM","393216:V+53SM8","393216:+53SM8+","393216:53SM8+O","393216:3SM8+OP","393216:SM8+OP8","393216:M8+OP8f","393216:8+OP8f4","393216:+OP8f4A","393216:OP8f4At","393216:P8f4AtS","393216:8f4AtSD","393216:f4AtSDB","393216:4AtSDBe","393216:AtSDBe9","393216:tSDBe9D","393216:SDBe9Dy","393216:DBe9DyI","393216:Be9DyIQ","786432:D85vzaw","786432:85vzawv","786432:5vzawvL","786432:vzawvLm","786432:zawvLmc","786432:awvLmcu","786432:wvLmcuC","786432:vLmcuCn","786432:LmcuCnD","786432:mcuCnDv","786432:cuCnDvV","786432:uCnDvV+","786432:CnDvV+5","786432:nDvV+53","786432:DvV+53S","786432:vV+53SM","786432:V+53SM8","786432:+53SM8+","786432:53SM8+O","786432:3SM8+OP","786432:SM8+OP8","786432:M8+OP8f","786432:8+OP8f4","786432:+OP8f4A","786432:OP8f4At","786432:P8f4AtS","786432:8f4AtSD","786432:f4AtSDB","786432:4AtSDBe","786432:AtSDBe9","786432:tSDBe9D","786432:SDBe9Dy","786432:DBe9DyI","786432:Be9DyIQ","393216:A5vz0CD","393216:5vz0CDv","393216:vz0CDvV","393216:z0CDvV/","393216:0CDvV/M","393216:CDvV/M8","393216:DvV/M8+","393216:vV/M8+x","393216:V/M8+x4","393216:/M8+x4j","393216:M8+x4jD","393216:8+x4jDB","393216:+x4jDBe","393216:x4jDBe9","393216:4jDBe9D","393216:jDBe9Dt"],"imphash":"d5b1104f7bf955d6b89a47291d5b603b"},"file_info":{"file_name":"joyn_downloader.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":14144398,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786043976000,"last_seen":1786043976000,"last_multi_scan":1786043976000}},"detections":{"summary":{"verdict":"malicious","score":80,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":171,"suspicious_count":14,"malicious_count":1,"total":186},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"joyn_downloader.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"joyn_downloader.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$26","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"joyn_downloader.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"joyn_downloader.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"joyn_downloader.exe\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"joyn_downloader.exe\")\n Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"BABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001212.00000001.197856.FF5E0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\w+(\\.\\w+)*; Source: \"00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp\")\n Found string - ^\\#LWP-Cookies-(\\d+\\.\\d+)Nc; Source: \"00000000-00001212.00000000.195936.811C0000.00000004.mdmp, 00000000-00001212.00000002.198921.8096D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"joyn_downloader.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"joyn_downloader.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"joyn_downloader.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"joyn_downloader.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"_ZipDecrypter..decrypter\" (Indicator: \".decrypt\"; Source: \"00000000-00001212.00000000.195936.803E0000.00000004.mdmp, 00000000-00001212.00000002.198921.803E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"joyn_downloader.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"joyn_downloader.exe\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"joyn_downloader.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"joyn_downloader.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"joyn_downloader.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"joyn_downloader.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"joyn_downloader.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"joyn_downloader.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"joyn_downloader.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"joyn_downloader.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"joyn_downloader.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001212)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"joyn_downloader.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000384)\n \"joyn_downloader.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000384)\n \"joyn_downloader.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001212)\n \"joyn_downloader.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"joyn_downloader.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000384)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"joyn_downloader.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000384)\n \"joyn_downloader.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: joyn_downloader.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"joyn_downloader.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"joyn_downloader.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"joyn_downloader.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"joyn_downloader.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"command /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00001212.00000000.195936.80AE0000.00000004.mdmp\n 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp\n Observed string: \"cmd /c ver\" (Indicator: \"cmd /c ver\") in Source: 00000000-00001212.00000000.195936.80AE0000.00000004.mdmp\n 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp\n Observed string: \"cmd /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00001212.00000000.195936.80AE0000.00000004.mdmp\n 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"joyn_downloader.exe\" issued a query \"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem\"\n \"joyn_downloader.exe\" issued a query \"SELECT Architecture FROM Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"joyn_downloader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001212-00002714-2054298837\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI3842\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"api-ms-win-core-file-l2-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"joyn_downloader.exe\" called \"CreateProcessW\" with parameter \"\"C:\\joyn_downloader.exe\"\" - (UID: 00000000-00000384)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"joyn_downloader.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001212)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"18.160.200.109:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"joyn_downloader.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-3.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\";Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00001212.00000000.195936.81354000.00000004.mdmp\n 00000000-00001212.00000001.197856.81354000.00000004.mdmp\n 00000000-00001212.00000002.198921.81382000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process joyn_downloader.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:1212:304:WilStaging_02\"\n Process joyn_downloader.exe created mutex with name \"SM0:1212:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$36","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$37","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"ping@lfw.org\"\n Pattern match: \"donald@stufft.io\"\n Pattern match: \"bob@redivi.com\"\n Pattern match: \"arek.bulski@gmail.com\"\n Pattern match: \"robinson@google.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/importlib_metadata/wiki/Development-Methodology\" (Indicator: \"github.com\")\n \"https://github.com/pypa/packaging\" (Indicator: \"github.com\")\n \"of cls.__bases__. See https://github.com/pypa/setuptools/issues/1024.\" (Indicator: \"github.com\")\n \"https://github.com/pypa/setuptools/discussions/5011\" (Indicator: \"github.com\")\n \"at .\" (Indicator: \"github.com\")\n \"https://github.com/construct/construct\" (Indicator: \"github.com\")\n \"`get_connection` has been deprecated in favor of `get_connection_with_tls_context`. Custom HTTPAdapter subclasses will need to migrate for Requests>=2.32.2. Please see https://github.com/psf/requests/pull/6710 for more details.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"joyn_downloader.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B7970000\n \"joyn_downloader.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B6890000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"joyn_downloader.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B8620000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a001d00000040c787b7fa7f0000@ntdll.dll\"\n \"220023001d00000018c787b7fa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"joyn_downloader.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"joyn_downloader.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"joyn_downloader.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"joyn_downloader.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"joyn_downloader.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$3b","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"joyn_downloader.exe\" has an executable section named \".text\"\n \"libcrypto-3.dll\" has an executable section named \".text\"\n \"libssl-3.dll\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \"fothk\"\n \"VCRUNTIME140_1.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3.dll\" : \"491\" [Source: libssl-3.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3c","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x379400\" greater than 0x100000\n Raw size of \".rdata\" is \"0x13f200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x379304\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x13f170\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$3e","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"joyn_downloader.exe\" (UID: 00000000-00001212) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\joyn_downloader.exe\", USERDNSDOMAIN=\"HUIqr61csoa6BiU\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI3842\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"joyn_downloader.exe\" (UID: 00000000-00001212) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"auth.joyn.de\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"joyn_downloader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"joyn_downloader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"joyn_downloader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"joyn_downloader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"joyn_downloader.exe\" (UID: 00000000-00001212)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"joyn_downloader.exe\" (UID: 00000000-00001212)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Amazon RSA 2048 M04, O=Amazon, C=US\" (SHA1: 71:29:A1:45:E6:A9:27:C4:6E:FA:3F:2F:48:F2:2D:02:04:A0:BF:96; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Amazon Root CA 1, O=Amazon, C=US\" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Starfield Services Root Certificate Authority - G2, O=\"Starfield Technologies\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"joyn_downloader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_ARC4.pyd\"\n \"joyn_downloader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"joyn_downloader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_chacha20.pyd\"\n \"joyn_downloader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"joyn_downloader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_raw_aes.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"joyn_downloader.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$41","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"joyn_downloader.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_ARC4.pyd\"\n \"joyn_downloader.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"joyn_downloader.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_chacha20.pyd\"\n \"joyn_downloader.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"joyn_downloader.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI3842\\Crypto\\Cipher\\_raw_aes.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"joyn_downloader.exe\" queries basic process information of the \"C:\\joyn_downloader.exe\" (UID: 384)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"joyn_downloader.exe\" reads file \"c:\\joyn_downloader.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\MSVCP140.DLL\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\VCRUNTIME140.DLL\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\VCRUNTIME140_1.DLL\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"joyn_downloader.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"joyn_downloader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei3842\\crypto\\cipher\\_arc4.pyd\"\n \"joyn_downloader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei3842\\crypto\\cipher\\_salsa20.pyd\"\n \"joyn_downloader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei3842\\crypto\\cipher\\_chacha20.pyd\"\n \"joyn_downloader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei3842\\crypto\\cipher\\_pkcs1_decode.pyd\"\n \"joyn_downloader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei3842\\crypto\\cipher\\_raw_aes.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"joyn_downloader.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80BE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80BE0000.00000004.mdmp\")\n Found reference to API \"SOCKSProxyManager\" (Indicator: \"socksproxy\"; Source: \"00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp\")\n Found reference to API \"SOCKSProxyManager.__init__\" (Indicator: \"socksproxy\"; Source: \"00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"api-ms-win-core-memory-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"joyn_downloader.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80BE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9224B000.00000002.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00001212.00000000.195936.80DE0000.00000004.mdmp\n 00000000-00001212.00000002.198921.80DE0000.00000004.mdmp\n Observed string: \"`cookies.txt' format. curl and lynx use this file format, too.\" (Indicator: \" curl \") in Source: 00000000-00001212.00000000.195936.81354000.00000004.mdmp\n 00000000-00001212.00000001.197856.81354000.00000004.mdmp\n 00000000-00001212.00000002.198921.8096D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$45","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000000.195936.81F20000.00000004.mdmp, 00000000-00001212.00000001.197856.80BE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.80BE0000.00000004.mdmp, 00000000-00001212.00000002.198921.81354000.00000004.mdmp, 00000000-00001212.00000002.198921.81F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"18.160.200.109\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"_raw_aes.pyd\"\n YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on process \"00000000-00001212\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"api-ms-win-core-file-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: joyn_downloader.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"joyn_downloader.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: joyn_downloader.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"joyn_downloader.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"joyn_downloader.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"joyn_downloader.exe\")\n Found reference to API \"K32EnumProcessModules\" (Indicator: \"EnumProcessModules\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"joyn_downloader.exe\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.809E0000.00000004.mdmp, 00000000-00001212.00000002.198921.809E0000.00000004.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"joyn_downloader.exe\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00001212.00000000.195936.80AE0000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80AE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"joyn_downloader.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00001212.00000000.195936.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.80CE0000.00000004.mdmp, 00000000-00001212.00000001.197856.81354000.00000004.mdmp, 00000000-00001212.00000001.197856.9E489000.00000002.mdmp, 00000000-00001212.00000002.198921.80CE0000.00000004.mdmp, 00000000-00001212.00000002.198921.81354000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00001212-00002714-2054184192\")\n Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001212-00002714-2054298837\")\n Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00001212-00002714-2054298837\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: joyn_downloader.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\joyn_downloader.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000384.00000000.195675.7EDD0000.00000004.mdmp, 00000000-00000384.00000001.197596.7EDD0000.00000004.mdmp, 00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001212.00000000.195936.803E0000.00000004.mdmp\n 00000000-00001212.00000000.195936.819C0000.00000004.mdmp\n 00000000-00001212.00000002.198921.803E0000.00000004.mdmp\n 00000000-00001212.00000002.198921.819C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"joyn_downloader.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"joyn_downloader.exe\")\n Found reference to API \"1234,740,3137,,RemoveDirectoryW,kernel32.dll,\"00:51:48.640\",RX=0,PX=0\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000384.00000002.198957.7EDD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: joyn_downloader.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001212.00000000.195936.811C0000.00000004.mdmp\n 00000000-00001212.00000001.197856.809E0000.00000004.mdmp\n 00000000-00001212.00000001.197856.9E45D000.00000002.mdmp\n 00000000-00001212.00000001.197856.9E489000.00000002.mdmp\n 00000000-00001212.00000002.198921.809E0000.00000004.mdmp\n 00000000-00001212.00000002.198921.812E7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"joyn_downloader.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"joyn_downloader.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"joyn_downloader.exe\")\n Found reference to API \"Terminate process; sends SIGTERM signal or uses TerminateProcess()\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp\")\n Found reference to API \"Terminate process; sends SIGKILL signal or uses TerminateProcess()\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001212.00000000.195936.80F30000.00000004.mdmp, 00000000-00001212.00000002.198921.80F30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"joyn_downloader.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"joyn_downloader.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\JOYN_DOWNLOADER.EXE\"; Value: \"15515F93D825DD010000000000000000000000000200000000\")\n \"joyn_downloader.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: joyn_downloader.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"joyn_downloader.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"joyn_downloader.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\JOYN_DOWNLOADER.EXE\"; Value: \"15515F93D825DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"AreFileApisANSI\" (Source: joyn_downloader.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: joyn_downloader.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: joyn_downloader.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: joyn_downloader.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: joyn_downloader.exe, API is part of module: KERNEL.APPCORE.DLL)\n Found string \"log10\" (Source: joyn_downloader.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$50","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"fothk\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"joyn_downloader.exe\" writes archive file \"%TEMP%\\_MEI3842\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$52","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"joyn_downloader.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"5\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 18.160.200.109 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\joyn_downloader.exe\" connects to 18.160.200.109 on port 443 (TCP); Domain: \"auth.joyn.de\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001212-00002713-2054174031\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$53","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$54","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$55","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetModuleFileNameW\n GetModuleHandleW\n WriteFile\n FindNextFileW\n CreateFileW\n CreateDirectoryW\n TerminateProcess\n UnhandledExceptionFilter\n GetCommandLineW\n GetCommandLineA\n Sleep\n LoadLibraryExW\n GetFileSizeEx\n VirtualProtect\n DeleteFileW\n CreateProcessW\n GetDriveTypeW\n GetStartupInfoW\n GetFileAttributesExW\n GetTempPathW\n FindFirstFileExW\n IsDebuggerPresent\n GetModuleHandleExW\n GetProcAddress\n FindFirstFileW\n GetWindowThreadProcessId\n GetCursorPos\n GetSystemInfo\n LoadLibraryW\n GetSystemDirectoryA\n LoadLibraryA\n VirtualAlloc\n WSAStartup\n listen\n send\n bind\n recvfrom\n sendto\n accept\n connect\n closesocket\n recv\n socket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$56","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"joyn_downloader.exe\" wrote 00000FB8 bytes to a remote process \"C:\\joyn_downloader.exe\" (Handle: 364)\n \"joyn_downloader.exe\" wrote 00000008 bytes to a remote process \"C:\\joyn_downloader.exe\" (Handle: 364)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":65,"files_written_count":118,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a74de45a730d15aa7027690","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"contacted_countries":["USA"],"submit_name":"joyn_downloader.exe","analysis_start_time":"2026-08-06T19:19:37+00:00","indicators_count":{"informative":171,"suspicious":38,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.160.200.109","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"dns_resolutions":[{"domain":"auth.joyn.de","address":"18.160.200.109","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}],"processes":[{"pid":384,"ppid":0,"name":"joyn_downloader.exe","command_line":"","sha256":"54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","normalized_path":"C:\\joyn_downloader.exe","uid":"00000000-00000384","icon":"$57"},{"pid":1212,"ppid":384,"name":"joyn_downloader.exe","command_line":"","sha256":"54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542","normalized_path":"C:\\joyn_downloader.exe","parent_uid":"00000000-00000384","uid":"00000000-00001212"}],"all_imported_dlls":["bcryptprimitives.dll","VCRUNTIME140_1.dll","kernel32.dll","user32.dll","combase.dll","shlwapi.dll","python313.dll","python3.dll","SHCore.dll","crypt32.dll","VxSSL64.dll","msvcp140.dll","ole32.dll","oleaut32.dll","VCRUNTIME140.dll","libcrypto-3.dll","msasn1.dll","clbcatq.dll","cryptsp.dll","kernel.appcore.dll","wbemcomn.dll","fastprox.dll","rasadhlp.dll","win32u.dll","advapi32.dll","vcruntime140.dll","bcrypt.dll","IPHLPAPI.DLL","wbemsvc.dll","dnsapi.dll","gdi32.dll","gdi32full.dll","fltLib.dll","uxtheme.dll","dwmapi.dll","ucrtbase.dll","rpcrt4.dll","wbemprox.dll","mswsock.dll","FWPUCLNT.DLL","msvcrt.dll","ws2_32.dll","vcruntime140_1.dll","version.dll","libffi-8.dll","propsys.dll","libssl-3.dll","nsi.dll","msctf.dll","imm32.dll","ntdll.dll","KernelBase.dll","msvcp_win.dll","sechost.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"python313.dll","sha256":"42d2031a17ca18517aed731c648fdfc3745df32d65d430c2a9f6d704d46f9ab4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"VCRUNTIME140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"VCRUNTIME140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"45afaf08d1cd7e43ac5ded47ed5fd708b86e835a9470c81e8130ed6955b84db8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"f73000652ca7ca7468ca6134663c99cbaf7bd97740bdbdd5d1e1e23ccfd5db75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"b153ff5d667c8297776f21c5f440cff28c3e3a5b1f748fd4700306e1fb283ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"6d14b49e8e21de08b9fa778f15c259dbd4feb9b54eb628d69bd50e5c86aa65a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"cac8fb2938ed80bd7eed42e3c68dead6cb41c30cfb567f23085986422f1a2747","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"882edcaa7b39dc9e330d1b3dcb2a770be2404d6358d76cf4cf5e52231bedac60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"e92ce06aa782a4e50a5bc95da5ac5ded0dc3da7e1152078002a12367aa7cc1af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"bd4e40b2f5d0f60feceeb7622166e1a61fb34ac2cd5484e1d9826c7cffa3029c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"1f818ccd44865c7c91c1ee5df7d21dc17840601d7470c0d1a486c5874304edd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"98e8728908f2872819728e709291529bac39751dec7d01c03a175c4688b9c233","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"1d7d6e883472eb5ddafe383adbaa5f8ed7b9d6267e7ade971bbff47ec4b47935","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"1516552690d6a38d65a8016d889f2ce1515649be6a45ef82cbed08a73690a7b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"9636be82c51d61dd990504d786fac0d51d41f73d22700a18d4fbbfcf6da5dff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"cacert.pem","sha256":"9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"libcrypto-3.dll","sha256":"ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"libssl-3.dll","sha256":"007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"python3.dll","sha256":"85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_Salsa20.pyd","sha256":"9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_chacha20.pyd","sha256":"ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_aes.pyd","sha256":"520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_aesni.pyd","sha256":"3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"e756f6970905657cf73ecb3f57bae55a67be29afa75ae4d16046b0f7229708eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"4e08856ff5203592c27f943f5586d2214b7c5dacde1b1ef75c2316590ab788c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"e83d5e5eb772070999f34a214ebffcf0a6068ebc1c4b4f1991188448f323808d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-fibers-l1-1-0.dll","sha256":"83ecd4fc05c5603621ab687657b8862175025c9910f8dc1b23135d2350dd9219","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"2783b85d98f4a92faf67a94fc04e9c2f6786627949984828d14deab1682bbe3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"22cf7040d9cb3dc79d941a6bbe4cebd5beaa1355d6e424843e6970404281e61e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"425e4ebee71347295e36776d415611d451e2a51b451df57da23ed8f8fb4664e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"e4011458af1397e26d0b233cbb2fa661faa6dae7b7a9541e9311c8af1ecb5e48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"9c5ea7a7e943c65da3aeff4da33b47fc4a3becea2f7a0b6aa2b632cd6d8b4632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"245cf5d5abc866d5ce327c4a1524ae3954ccfc9a7284c817fa15962695e6b6fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"3add350dcd79c64a98e47adf733f26c9fdf47df097b060f04f067cdaf32e99cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"42f88e44e488a74af796e8c2a2548879764a40e554f35d1deb8eaff5def09e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"5c566535a9ac607fa99a665ab246ffb78767995dde86c4a9a5c518dd22b76e56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"02fd3b0adf86967b6fc133797c12fa9ee8d0cf64778b5ca937b56e86ac726343","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"c9103f6afdd8a6fea734da372911b0a3b018a84e00675a9355ea6f091e641781","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"2d04920e410d81e3a044a76724a23cf892b23a5b382fb079abd6f689199c7428","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"edd387b01cb9d85a44e27e656e5ea6898b8e9604682db29cb87ee3236f3a1d9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"bf651fcd0f10dc528caa3168abd6ea528458c78aaa75b93b3c615d5a18567192","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"b84f44a882b2caa6d0bc3c01e8d012e881324b800fd39e2728fecdc65315a245","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"d9fc17ce5dd5aecac0dca2d9a17a20271a13f68cd6cfa89163d72904a72f6b8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"d7fab15f2d1298a11822ce5c7756da2eab1112bd3561b22db6b25a5a8acafad6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"31fc3b5665c3bb2006496b5cbb0e5667b186263a867dbe5a760a996305f4f514","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"a7433b9f8965f914da00dda4ede62d4db69f561a548cbc8d312293d0917a33c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"554b506ca648507f10eeb5bae124ff91594f5fdd81d33b0171334be7ad5c7816","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"a7f53b76e7ea837f45bdb8712a864fb0c427c5eb863d155a72b422b96417ea10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_ARC4.pyd","sha256":"f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_pkcs1_decode.pyd","sha256":"320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_arc2.pyd","sha256":"1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_blowfish.pyd","sha256":"6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_cast.pyd","sha256":"7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_cbc.pyd","sha256":"a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_cfb.pyd","sha256":"cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_ctr.pyd","sha256":"aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_des.pyd","sha256":"0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_des3.pyd","sha256":"b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_ecb.pyd","sha256":"98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_eksblowfish.pyd","sha256":"29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_ocb.pyd","sha256":"c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_raw_ofb.pyd","sha256":"1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_BLAKE2b.pyd","sha256":"1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"_BLAKE2s.pyd","sha256":"d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\PublicKey\\_curve25519.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\PublicKey\\_curve448.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\Crypto\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\charset_normalizer\\cd.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\charset_normalizer\\md.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\device.wvd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\google\\_upb\\_message.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\python313.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\_MEI3842\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"C:\\auth\\auth.json","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]},{"name":"SM0:1212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a74de45a730d15aa7027690"}]}]}},"report_ids":{"sandbox_job_ids":["6a74de45a730d15aa7027690"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 54ff03435943… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 54ff03435943…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/1 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 54ff03435943… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 54ff03435943…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/1 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/54ff034359436ccde903ef0dd7d72716829a1180844acc1c7f4e932f9b201542"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 54ff03435943… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 54ff03435943…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/1 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]