26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] a7:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T431,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 55790767e48d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 55790767e48d…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8"],"about":{"@type":"SoftwareApplication","name":"PoligonVRSetup.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb31,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") file/memory contains long string(File: "_block.cp314-win_amd64.pyd") Found string "Failed to import '%.20s.decompress' - cannot initialise module strings. String compression was configured with the C macro 'CYTHON_COMPRESS_STRINGS=%d'." (Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "SSL_COMP_add_compression_method" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "bad decompression" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression disabled" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "illegal point compression" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "inconsistent compression" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "invalid compression algorithm" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "old session compression algorithm not returned" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "required compression algorithm missing" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "sslv3 alert decompression failure" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp, 00000000-00001092.00000001.76969.60A18000.00000002.mdmp") Found string "decompression failure" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression_methods (len=%d)" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "compression_method: %s (0x%02X)" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "SSL_COMP_get_compression_methods" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "SSL_COMP_set0_compression_methods" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "SSL_client_hello_get0_compression_methods" (Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp")28:T7a9,Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "Profile buffer could not be freed using LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "SID could not be freed using LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CF610000.00000004.mdmp")29:T2442,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "BatchedWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")2a:T695,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OO:SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OOi:OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")2b:T18f4,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O:LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "OOl:LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O:FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "stub.WinApi.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.WinApi.FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "Using cdll.LoadLibrary():" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp")2c:Tc5f,Found reference to API "O:RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "RegOverridePredefKey" (Indicator: "RegOverridePredefKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:RegOverridePredefKey" (Indicator: "RegOverridePredefKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegRestoreKey" (Indicator: "RegRestoreKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO|k:RegRestoreKey" (Indicator: "RegRestoreKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OOiO:RegSetValue" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegSetValue" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OOOiO:RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OlO:RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")2d:Tca0,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "win32crypt.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_SHA512.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_SHA384.pyd") file/memory contains long string with (Indicator: "RC2"; File: "_raw_arc2.pyd") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005552-00000BC0-183214039") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "TLS_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "DHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "DHE-DSS-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "ADH-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found reference to "TLS_DH_anon_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp")2e:T73e,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE")2f:Tf53,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00004916-00000C15-160317180 [PID: 4916] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00004916-00000C15-160335434 [PID: 4916] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00004916-00000C15-160779783 [PID: 4916] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00004916-00000C15-160786914 [PID: 4916] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-168796547 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-168803793 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-169185079 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-169192231 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-169691442 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-169698560 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-171041585 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-171049356 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172151762 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172158967 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172572898 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172580563 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172894282 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-172901196 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-173163973 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-173171307 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-174733748 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-174740862 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-175512965 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-175520236 [PID: 1092] "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queried SystemProcessInformation at 00000000-00001092-00000C15-177120808 [PID: 1092]30:T937,Found reference to API "stub.Discord.decrypt" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_chrome_key" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_cookie_v20" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_cookie_v10" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_with_cng" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_cookie_v20_chrome" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Cookie.decrypt_cookie_v10_chrome" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Password.decrypt_chrome_key" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Password.decrypt_with_cng" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Password.decrypt_password_v20" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Password.decrypt_password_v10" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Password.decrypt_password" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Decryptor.LoadNSS" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Decryptor.UnLoadNSS" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Decryptor.SetProfile" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "stub.Decryptor.DecryptPassword" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp")31:T7f8,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found api reference "CryptEnumProvidersW" (Indicator: "CryptEnumProvidersW"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp")32:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}33:T471,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Able to access crypto-related API (String) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms34:T9c5,file/memory contains long string with (Indicator: "github.com"; File: "METADATA") file/memory contains long string with (Indicator: "github.com"; File: "downloads.txt") Found string "github.com" (Indicator: "github.com"; File: "PCAP") Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "argument types, see https://github.com/python/cpython/issues/86361." (Indicator: "github.com"; Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp")35:T655,file/memory contains long string(File: "win32api.pyd") Found string "UserName" (Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found string ":GetLogicalDrives" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found string "GetLogicalDrives" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string ":GetUserName" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "GetUserName" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found string "GetUserNameEx" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "i:GetUserNameEx" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "GetUserNameExW" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "GetUserNameW" (Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")36:T7a0,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "win32api.pyd") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00001092-00000C2C-173100845") Found string ":GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string ":GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp")37:T4c8,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001092-00000C2C-173493389") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005552-00000C2C-182739360") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00005552-00000C2C-188114898") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp")38:Tf47,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "|O:GetDiskFreeSpace" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "|O:GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "|O:GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetDiskFreeSpace" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp")39:T492,Found reference to API "iiO|O:GetDateFormat" (Indicator: "GetDateFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetDateFormat" (Indicator: "GetDateFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "iiO|O:GetTimeFormat" (Indicator: "GetTimeFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetTimeFormat" (Indicator: "GetTimeFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")3a:Tcf1,Found system information discovery API: "GetEnvironmentStringsW" in file "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" Found system information discovery API: "GetSystemInfo" in file "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" Found system information discovery API: "GetUserObjectInformationW" in file "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" Found system information discovery API: "GetMonitorInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found system information discovery API: "O:GetMonitorInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "O:ExpandEnvironmentStrings" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStrings" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp" Found system information discovery API: ":GetSystemInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found system information discovery API: ":GetNativeSystemInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001092.00000000.75049.60B60000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ" in "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp"3b:T932,Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "|i:GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API ":GetKeyboardLayoutName" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API ":GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetKeyboardLayoutName" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")3c:T84d,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "win32api.pyd") file/memory contains long string with (Indicator: "sendmessage"; File: "win32event.pyd") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005552-00000C2C-186639195") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00005552-00000C2C-186639236") Found reference to API "OI|OO:PostMessage" (Indicator: "postmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OI|OO:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")3d:T2195,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9388a99fb7f000080000000000000000000000000000000f04297cd060200001033bc9bfb7f000000000000000000000000dc9afb7f000090875e0bc900000010418799fb7f0000e0652acd0602000050875e0bc9000000000000000000000000000000000000000100000000000000b8408799fb7f0000000000000000000001000000000000000000dc9afb7f00003b4d3299fb7f00000000000000000000488c5e0bc90000000000000000000000d02aee9afb7f000010b3549bfb7f0000e8f88699fb7f000010b3549bfb7f0000d02aee9afb7f00000d000000fb7f00000d00000000000000a0f6449bfb7f0000f587e99afb7f0000d02aee9a (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000a0325e0bc90000000000000000000000020000000000000080315e0bc900000010000000000004004a45f695245c00003100310062003600000000000000000000000000000000005828429afb7f0000b0335e0bc9000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd70b0325e0bc9000000c7bc219afb7f0000360044003900420036007d0000000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd708a44f695245c0000378f1c9afb7f00000000000000000000000000000000000088335e0bc9000000b8335e0bc90000000000000000000000000000000000000000000000 (UID: 00000000-00001092) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000018e64fd0fd00000018000000fd000000a0c53f5a2de300000f44e21d5f0200000100000000000000b0e54fd0fd000000b057e11d5f0200009043e21d5f0200001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000789afb7f00008a5a8da1ebf40000e046789afb7f00001044e21d5f0200009806799afb7f000080f9e11d5f02000000007399fb7f00000000000000000000e046789afb7f00000300000000000000f385b99bfb7f00006e47789afb7f00002766b99bfb7f0000f0e54fd0 (UID: 00000000-00003460) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003460) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003460) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005552) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005552) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9388a99fb7f0000800000000000000000000000000000009017c3289b0100001033bc9bfb7f000000000000000000000000dc9afb7f0000d0d497d86b00000010418799fb7f000010528c0e9b01000090d497d86b000000000000000000000000000000000000000100000000000000b8408799fb7f0000060000000000000001000000000000000000dc9afb7f00003b4d3299fb7f0000000000000000000048d997d86b0000000000000000000000d02aee9afb7f000010b3549bfb7f0000e8f88699fb7f000010b3549bfb7f0000d02aee9afb7f00000d000000fb7f00000d00000000000000a0f6449bfb7f0000f587e99afb7f0000d02aee9a (UID: 00000000-00005552)3e:T760,"powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000030478c0e9b010000c0fbd18efb7f00000001000000000000b8fbd18efb7f0000000000000000000080cbfd99fb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ad18efb7f00000000000000000000b8fbd18efb7f000000000000 (UID: 00000000-00005552) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000c02149aa32020000c0fbc98efb7f00000001000000000000b8fbc98efb7f0000000000000000000080cbfd99fb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ac98efb7f00000000000000000000b8fbc98efb7f000000000000 (UID: 00000000-00003188) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000a0e7cb3e4d020000c0fbc98efb7f00000001000000000000b8fbc98efb7f0000000000000000000080cbfd99fb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ac98efb7f00000000000000000000b8fbc98efb7f000000000000 (UID: 00000000-00002752) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000f056db001b020000c0fbc98efb7f00000001000000000000b8fbc98efb7f0000000000000000000080cbfd99fb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ac98efb7f00000000000000000000b8fbc98efb7f000000000000 (UID: 00000000-00004544) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000050df9bafc8010000c0fbc98efb7f00000001000000000000b8fbc98efb7f0000000000000000000080cbfd99fb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ac98efb7f00000000000000000000b8fbc98efb7f000000000000 (UID: 00000000-00002260)3f:T427,"powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00005552) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00005552) "WMIC.exe" called "GetLocaleInfoA" with parameter "1033" - (UID: 00000000-00009060) "WMIC.exe" called "GetLocaleInfoA" with parameter "1033" - (UID: 00000000-00008740) "powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00003188) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003188) "powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00002752) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00002752) "powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00004544) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00004544) "powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00002260) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00002260)40:T1173,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API ":GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API ":GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")41:T542,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")42:T1059,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp")43:T1173,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API ":GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API ":GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")44:T555,Found reference to API ":GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "|i:GetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")45:T13a8,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161475766 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161485326 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161514671 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161515380 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161520126 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161520853 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161525594 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161526368 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161538464 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161539259 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161543729 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161544440 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161549512 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161550316 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161555646 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161556340 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161563152 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161563933 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161568298 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161569021 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161573392 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161574132 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-161578568 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" at 00000000-00004916-00000C17-161579301 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" at 00000000-00004916-00000C17-16158915846:Tb55,Found registry modification API: "OO:RegConnectRegistry" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegConnectRegistry" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry modification API: "RegCopyTree" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry modification API: "OOO:RegCopyTree" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "OO:RegCreateKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegCreateKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry modification API: "OOk|OkOO:RegCreateKeyEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegCreateKeyTransacted" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegCreateKeyEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry modification API: "OOO:RegLoadKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegLoadKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry modification API: "RegCreateKeyTransactedW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegCopyTreeW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry modification API: "RegLoadKeyW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp"47:T410,file/memory contains long string with (Indicator: "MoveFileW"; File: "win32file.pyd") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found string "MoveFileW" (Indicator: "MoveFileW"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found string "MoveFileWithProgressW" (Indicator: "MoveFileW"; Source: "00000000-00001092-00000C2C-173793259") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")48:T1078,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\Cipher (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\Hash (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\Math (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\Protocol (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\PublicKey (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Crypto\Util (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\Cipher (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\Hash (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\Math (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\Protocol (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\PublicKey (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Cryptodome\Util (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\Pythonwin (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\certifi (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\charset_normalizer (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\lz4-4.4.5.dist-info (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\lz4-4.4.5.dist-info\licenses (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\lz4 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\lz4\block (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\psutil (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\pywin32_system32 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI49162\setuptools (UID: 00000000-00004916)49:Td5f,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter ""C:\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe"" - (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Ca" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "wmic os get caption"" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMod" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_Operating" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDi" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -Expa" - (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandPr" - (UID: 00000000-00001092) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" - (UID: 00000000-00003460) "cmd.exe" called "CreateProcessW" with parameter "wmic os get caption" - (UID: 00000000-00006872) "cmd.exe" called "CreateProcessW" with parameter "wmic os get caption" - (UID: 00000000-00005716) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"" - (UID: 00000000-00004136) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandP" - (UID: 00000000-00001596), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Se" - (UID: 00000000-00008096) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState" - (UID: 00000000-00008512), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRu" - (UID: 00000000-00000448)4a:T143e8,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\python314.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\python3 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_ctypes.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_bz2.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_lzma.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_zstd.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_socket.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_queue.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_wmi.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_hashlib.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_ssl.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\stub.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32api.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32security.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter ntdsapi.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32crypt.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32process.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32file.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter sfc.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_sqlite3.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Util\_cpuid_c.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Cipher\_raw_aes.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Cipher\_raw_aesni.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Cipher\_chacha20.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Hash\_BLAKE2s.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Crypto\Hash\_poly1305.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_asyncio.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_overlapped.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\select.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\psutil\_psutil_windows.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\charset_normalizer\md.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\charset_normalizer\md__mypyc.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\unicodedata.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\_uuid.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\pywin32_system32\pywintypes314.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\pywin32_system32\pythoncom314.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\win32\win32event.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\lz4\_version.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\lz4\block\_block.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Util\_cpuid_c.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aes.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aesni.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Hash\_SHA1.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Hash\_SHA256.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Hash\_BLAKE2s.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Util\_strxor.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Cipher\_Salsa20.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI49162\Cryptodome\Protocol\_scrypt.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00001092) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003460) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\cf76ddafebd937c833368b4b58fae120\Microsoft.Management.Infrastr (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00005552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00005552) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006872) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006872) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006872) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006872) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009060) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009060) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009060) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009060) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00009060) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00009060) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005716) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005716) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005716) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005716) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008740) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008740) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008740) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008740) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008740) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008740) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004136) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004136) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004136) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003188) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003188) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001596) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\cf76ddafebd937c833368b4b58fae120\Microsoft.Management.Infrastr (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002752) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008096) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008096) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008096) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008096) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\cf76ddafebd937c833368b4b58fae120\Microsoft.Management.Infrastr (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004544) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008512) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008512) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008512) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008512) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002260) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000448) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000448) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000448) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000448) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003096) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003096)4b:T46b,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateFileMoniker" (Indicator: "CreateFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")4c:T52e,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OO:RegUnLoadKey" (Indicator: "RegUnLoadKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "RegUnLoadKey" (Indicator: "RegUnLoadKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")4d:T495,Found reference to API "OOOOOi:ShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "ShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "s|i:WinExec" (Indicator: "WinExec"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")4e:Tbcd,Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Ca" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-25978112612") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Ca" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-25978112612") Found string "%WINDIR%\system32\cmd.exe /c "wmic os get caption"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-61386322400") Found string "%WINDIR%\system32\cmd.exe /c "wmic os get caption"" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-61386322400") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMod" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-92316025014") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMod" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-92316025014") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_Operating" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-118422978822") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_Operating" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-118422978822") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDi" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-149074630470") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDi" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-149074630470") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -Expa" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-182101277038") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -Expa" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-182101277038") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandPr" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00001092-00000C47-220587049068") Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandPr" (Indicator: "cmd.exe /c"; Source: "00000000-00001092-00000C47-220587049068")4f:T8f0,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "?PyWinObject_FreeResourceId@@YAXPEA_W@Z" (Indicator: "FreeResource"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OOO|H:LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "FindResourceEx" (Indicator: "FindResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "?PyWinObject_FreeResourceIdA@@YAXPEAD@Z" (Indicator: "FreeResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp") Found reference to API "?PyWinObject_FreeResourceId@@YAXPEA_W@Z" (Indicator: "FreeResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")50:T4ed,Found reference to API "OOOkk:LogonUser" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LogonUser" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LogonUserEx" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OOOkk:LogonUserEx" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LogonUserExW" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LogonUserExExW" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LogonUserW" (Indicator: "LogonUser"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp")51:T76e,Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OO:MoveFile" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OOi:MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")52:T64f,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp") Found reference to API ":GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "CommandLineToArgv" (Indicator: "CommandLineToArgv"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp")53:T5fe,Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OOi:OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "kik:OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CF610000.00000004.mdmp")54:T7ed,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OO:LookupPrivilegeName" (Indicator: "LookupPrivilegeName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LookupPrivilegeName" (Indicator: "LookupPrivilegeName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LookupPrivilegeNameW" (Indicator: "LookupPrivilegeName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found reference to API "kik:OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")55:Taad,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")56:T903,"libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-3.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-3.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-3.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-3.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-3.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-3.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-3.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-3.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-3.dll" contains export function called "AES_decrypt" at ordinal 2557:T7d3,Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-CimInstance"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimInstance"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimInstance"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Invoke-CimMethod"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimAssociatedInstance"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Register-CimIndicationEvent"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimSession"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSessionOption"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimClass"; File: "AMSI")58:Tdee,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\Cipher (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\Hash (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\Math (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\Protocol (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\PublicKey (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Crypto\Util (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\Cipher (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\Hash (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\Math (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\Protocol (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\PublicKey (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Cryptodome\Util (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\Pythonwin (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\certifi (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\charset_normalizer (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\lz4-4.4.5.dist-info (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\lz4-4.4.5.dist-info\licenses (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\lz4 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\lz4\block (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\psutil (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\pywin32_system32 (UID: 00000000-00004916) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" with parameter %TEMP%\_MEI49162\setuptools (UID: 00000000-00004916)59:T9cf,Process 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1092:304:WilStaging_02" Process 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1092:120:WilError_03" Process 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe created mutex with name "Local\SM0:1092:304:WilStaging_02" Process 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe created mutex with name "SM0:1092:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3460:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3460:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5552:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5552:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:5552:120:WilError_03" Process powershell.exe created mutex with name "SM0:5552:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:5552:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6872:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:6872:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9060:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9060:120:WilError_03" Process WMIC.exe created mutex with name "Local\SM0:9060:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:9060:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5716:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:5716:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8740:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8740:120:WilError_03" Process WMIC.exe created mutex with name "Local\SM0:8740:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:8740:120:WilError_03"5a:T4b8,Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" (UID: 00000000-00005552) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"" (UID: 00000000-00003188) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (UID: 00000000-00002752) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (UID: 00000000-00004544) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState"" (UID: 00000000-00002260) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids"" (UID: 00000000-00003096)5b:T1093,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]5c:Td1d,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pythoncom314.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pywintypes314.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "stub.cp314-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32ui.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ec_ws.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_zstd.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_cffi_backend.cp314-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32file.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT5d:T79a7,"Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp " BadgesBookmarks Bar\BraveSoftware\Brave-Browser\User Data\DefaultBraveSoftware\Brave-Browser\User DataBrave-BrowserCOFFEE-SHOP" in Source: 00000000-00001092.00000000.75049.CD77E000.00000004.mdmp " Not hosted IP (0)Note that Cython is deliberately stricter than PEP-484 and rejects subclasses of builtin types. If you need to pass subclasses then set the 'annotation_typing' directive to False.Opera GXOpera GX StableOpera-GxOpera SoftwareOpera Software\Opera GX\Opera Software\Opera GX Stable\DefaultOpera Software\Opera Stable\Opera Software\Opera Stable\DefaultOpera StableOther BookmarksPC-DANIELEPROGRAMFILES(X86)PROPERTY-LTD<:Partnered_Server_Owner:1442810394727940177>Passwh" in Source: 00000000-00001092.00000000.75049.CD77E000.00000004.mdmp " BadgesBookmarks Bar\BraveSoftware\3" in Source: 00000000-00001092.00000000.75049.CD77E000.00000004.mdmp "oftwareOpera Software\Opera GX\Opera Software\Opera GX Stable\DefaultOpera Software\Operc" in Source: 00000000-00001092.00000000.75049.CD77E000.00000004.mdmp "\Opera Software\Opera Stable\DefaultOpera StableOther BookmarksPC-DANIELEPROGRAMFILES(X86)PROPERTY-LTD<:Partnered_Server_Owner:1442810394727940177>Password: " in Source: 00000000-00001092.00000000.75049.CD77E000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001092.00000000.75049.CD9F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" in Source: 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp "\Opera Software\Opera GX Stable\Default" in Source: 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp "\Opera Software\Opera Stable\Default" in Source: 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp "reg query "HKCU\Control Panel\Desktop" /v Wallpaper" in Source: 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp "Opera Software\Opera GX" in Source: 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0" in Source: 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00001092.00000001.76969.8B193000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00001092.00000001.76969.8B193000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00001092.00000001.76969.8B193000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" in Source: 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" in Source: 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001092.00000001.76969.CD9F0000.00000004.mdmp "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" in Source: 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp "\Opera Software\Opera GX Stable\Default" in Source: 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp "\Opera Software\Opera Stable\Default" in Source: 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001092.00000001.76969.CE43E000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp "reg query "HKCU\Control Panel\Desktop" /v Wallpaper" in Source: 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp "Opera Software\Opera GX" in Source: 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0" in Source: 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001092.00000001.76969.D00A5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C" in Source: 00000000-00001092.00000001.76969.D00A5000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" in Source: 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Network\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Local State" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Network\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Network\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Local State" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Network\Cookies" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Local State" in Source: 00000000-00001092.00000001.76969.D10E0000.00000004.mdmp "SOFTWARE\Python\PythonCore\%s\PythonPath\win32com" in Source: 00000000-00001092.00000001.76969.D11E0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" in Source: 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" in Source: 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" in Source: 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp "\Opera Software\Opera GX Stable\Default" in Source: 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp "\Opera Software\Opera Stable\Default" in Source: 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001092.00000002.78890.CE43E000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp "reg query "HKCU\Control Panel\Desktop" /v Wallpaper" in Source: 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp "Opera Software\Opera GX" in Source: 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0" in Source: 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001092.00000002.78890.CED10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001092.00000002.78890.D00A5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C" in Source: 00000000-00001092.00000002.78890.D00A5000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" in Source: 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp "SOFTWARE\Python\PythonCore" in Source: 00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp "SOFTWARE\WOW6432Node\Python\PythonCore" in Source: 00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp " registry(r"HKEY_LOCAL_MACHINE\Software")" in Source: 00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Network\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Local State" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Network\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Network\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera {channel}\Local State" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Network\Cookies" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "Opera Software\Opera GX {channel}\Local State" in Source: 00000000-00001092.00000002.78890.D10E0000.00000004.mdmp "SOFTWARE\Python\PythonCore\%s\PythonPath\win32com" in Source: 00000000-00001092.00000002.78890.D11E0000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002260.00000000.79995.AF8E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002260.00000000.79995.DA343000.00000002.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002260.00000001.80606.AF8E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002260.00000001.80606.C9D50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002260.00000001.80606.C9D50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{e7d35cfa-348b-485e-b524-252725d697ca}" in Source: 00000000-00002260.00000001.80606.C9E05000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00002260.00000001.80606.C9E05000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00002260.00000001.80606.C9E05000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00002260.00000001.80606.C9E05000.00000004.mdmp "\Registry\Machine\Software\Classes\Wp" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Use\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}E=C:\Users\Hk" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\Software\C" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002752.00000000.78303.3EBE0000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002752.00000000.78303.3EBE0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002752.00000000.78303.3EBE0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002752.00000001.78699.3EBE0000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002752.00000001.78699.3EBE0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002752.00000001.78699.3EBE0000.00000004.mdmp "ead3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002752.00000001.78699.590B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002752.00000001.78699.590B0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00002752.00000001.78699.590B0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00002752.00000001.78699.5917C000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00002752.00000001.78699.5917C000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002752.00000001.78699.592B2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00002752.00000001.78699.592B2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "hine\Software\Classes\WOW64B" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00002752.00000001.78699.5932E000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003188.00000000.77603.90110000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003188.00000000.77603.90110000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003188.00000000.77603.90110000.00000004.mdmp "y\Machine\Software\Classes\AppID0" in Source: 00000000-00003188.00000000.77603.90110000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003188.00000001.77878.8B193000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003188.00000001.77878.8B193000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003188.00000001.77878.8B193000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003188.00000001.77878.90110000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003188.00000001.77878.90110000.00000004.mdmp "y\Machine\Software\Classes\AppID0" in Source: 00000000-00003188.00000001.77878.90110000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004544.00000000.79110.00CD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004544.00000001.79581.00CF7000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004544.00000001.79581.1B131000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000" in Source: 00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp "CommonProgramFiles=C:\Program Files\Common Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0" in Source: 00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp "-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}.MSC;.CPL" in Source: 00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004916.00000001.76416.867C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004916.00000002.78334.867C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005552.00000000.75837.0E7E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005552.00000000.75837.0E7E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005552.00000000.75837.0E7E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005552.00000000.75837.DA343000.00000002.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005552.00000001.76346.0E89A000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005552.00000001.76346.28C20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005552.00000001.76346.28C20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005552.00000001.76346.28C20000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005552.00000001.76346.28C20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005552.00000001.76346.28E77000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005552.00000001.76346.28E77000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005552.00000001.76346.28E77000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005552.00000001.76346.28E77000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005552.00000001.76346.28E77000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{0(" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0_" in Source: 00000000-00005552.00000001.76346.28EC2000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008740.00000000.77196.8ABCB000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00008740.00000000.77196.8B193000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00008740.00000000.77196.8B193000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00008740.00000000.77196.8B193000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00009060.00000000.76790.8B193000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00009060.00000000.76790.8B193000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00009060.00000000.76790.8B193000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00009060.00000000.76790.D0A00000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00009060.00000000.76790.D0AAE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00009060.00000000.76790.D0AAE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}" in Source: 00000000-00009060.00000000.76790.D0AAE000.00000004.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00009060.00000000.76790.D15D1000.00000002.mdmp5e:T4b9,"C L A U D E X - EDGE DOWNLOADS EXTRACTOR File Path: C:\Users\HAPUBWS\Downloads\nvm-setup.exe Download URL: https://github.com/coreybutler/nvm-windows/releases/tag/1.1.12 Start Time: 2024-07-15 21:51:09.545112 End Time: 2024-07-15 21:51:12.009320 Size: 5784456/5784456 bytes" (Indicator: "github.com") "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com") "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com") "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com") "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com") "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com") "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com") "argument types, see https://github.com/python/cpython/issues/86361." (Indicator: "github.com")5f:T9897,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "KERNEL32" at base 7ffb9abd0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb61320000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "RPCRT4.DLL" at base 7ffb9aca0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "VCRUNTIME140.DLL" at base 7ffb8e7a0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ffb8d890000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "NTDLL.DLL" at base 7ffb9bb70000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "KERNELBASE" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb965c0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "KERNELBASE.DLL" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "KERNEL32.DLL" at base 7ffb9abd0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\PYTHON314.DLL" at base 7ffb60c30000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\PYTHON3" at base 206cc5b0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_CTYPES.PYD" at base 7ffb83ae0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_BZ2.PYD" at base 7ffb83ac0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_LZMA.PYD" at base 7ffb83a90000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_ZSTD.PYD" at base 7ffb60bb0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "PSAPI" at base 206cc620000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb990f0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_SOCKET.PYD" at base 7ffb613c0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_QUEUE.PYD" at base 7ffb8a1c0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_WMI.PYD" at base 7ffb744d0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_HASHLIB.PYD" at base 7ffb613a0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_SSL.PYD" at base 7ffb60670000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\STUB.CP314-WIN_AMD64.PYD" at base 7ffb60410000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32API.PYD" at base 7ffb603e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "SECUR32.DLL" at base 7ffb8d910000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32SECURITY.PYD" at base 7ffb60380000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "SECURITY.DLL" at base 206cc790000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "NTDSAPI.DLL" at base 7ffb60350000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32CRYPT.PYD" at base 7ffb60320000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32PROCESS.PYD" at base 7ffb60300000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32FILE.PYD" at base 7ffb602d0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "SFC.DLL" at base 206ccab0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_SQLITE3.PYD" at base 7ffb602b0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\UTIL\_CPUID_C.PYD" at base 7ffb6b520000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\CIPHER\_RAW_AES.PYD" at base 7ffb61390000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\CIPHER\_RAW_AESNI.PYD" at base 7ffb60110000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\CIPHER\_CHACHA20.PYD" at base 7ffb60100000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\HASH\_BLAKE2S.PYD" at base 7ffb600f0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTO\HASH\_POLY1305.PYD" at base 7ffb600e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "PSAPI.DLL" at base 206cc620000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "ADVAPI32.DLL" at base 7ffb9a6d0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_ASYNCIO.PYD" at base 7ffb600c0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_OVERLAPPED.PYD" at base 7ffb600b0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb98450000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\SELECT.PYD" at base 7ffb600a0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\PSUTIL\_PSUTIL_WINDOWS.PYD" at base 7ffb60080000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "IPHLPAPI.DLL" at base 7ffb97b00000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "NTDLL" at base 7ffb9bb70000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "WTSAPI32.DLL" at base 7ffb91e30000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CHARSET_NORMALIZER\MD.CP314-WIN_AMD64.PYD" at base 7ffb60070000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CHARSET_NORMALIZER\MD__MYPYC.CP314-WIN_AMD64.PYD" at base 7ffb60040000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\UNICODEDATA.PYD" at base 7ffb5ff80000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\_UUID.PYD" at base 7ffb5ff70000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\PYWIN32_SYSTEM32\PYWINTYPES314.DLL" at base 7ffb603b0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\PYWIN32_SYSTEM32\PYTHONCOM314.DLL" at base 7ffb5feb0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "URLMON.DLL" at base 7ffb89430000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\WIN32\WIN32EVENT.PYD" at base 7ffb5fea0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffb5fe50000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb9a6d0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb8c5a0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb8b270000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb8b9f0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb992e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb8bc50000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "AMSI.DLL" at base 7ffb8b1e0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb8df60000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb8b160000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%WINDIR%\SYSTEM32\WLH9QTRH.DLL" at base 7ffb63c70000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\LZ4\_VERSION.CP314-WIN_AMD64.PYD" at base 7ffb5fc40000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\LZ4\BLOCK\_BLOCK.CP314-WIN_AMD64.PYD" at base 7ffb5fc20000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\UTIL\_CPUID_C.PYD" at base 7ffb5fc10000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\CIPHER\_RAW_AES.PYD" at base 7ffb5fc00000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\CIPHER\_RAW_AESNI.PYD" at base 7ffb5fbf0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\HASH\_SHA1.PYD" at base 7ffb5fbe0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\HASH\_SHA256.PYD" at base 7ffb5fbd0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\HASH\_BLAKE2S.PYD" at base 7ffb5fbc0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\UTIL\_STRXOR.PYD" at base 7ffb5fbb0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\CIPHER\_SALSA20.PYD" at base 7ffb5fba0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "%TEMP%\_MEI49162\CRYPTODOME\PROTOCOL\_SCRYPT.PYD" at base 7ffb5fb90000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "OLE32.DLL" at base 7ffb9a840000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "USER32" at base 7ffb9a510000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "SHELL32" at base 7ffb9adc0000 "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffb97fe0000 "cmd.exe" loaded module "KERNEL32" at base 7ffb9abd0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb992e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb992e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb992e0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb99df0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb992e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb992e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb992e0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb61320000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb9abd0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb9bb70000 "cmd.exe" loaded module "KERNELBASE" at base 7ffb992e0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffb97fe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb992e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb992e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb992e0000 "powershell.exe" loaded module "KERNEL32" at base 7ffb9abd0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb61320000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb9abd0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb9a6d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb6ef20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb9a070000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb97fe0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb8df60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb5f1e0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb9a510000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb6efc0000 "powershell.exe" loaded module "NTDLL" at base 7ffb9bb70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb9a160000 "powershell.exe" loaded module "PSAPI.DLL" at base 19b0ea80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb9aca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffb5dc20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb9a840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb9a160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb9aaf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffb5d000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffb5c570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb857e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb97f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb990f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb5a4f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb9a160000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb9a160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb9bb70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb9adc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb98f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb99170000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb98780000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb8b1e0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb99170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb8df60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb8b160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb91af0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb8ed10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb85790000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffb916f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WLH9QTRH.DLL" at base 7ffb63c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb5a3b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb5a310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb59a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb598f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb59780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb98870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffb58df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb58a80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb58950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb588e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb58800000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb587b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb8d910000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb98230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb965c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffb626a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb9abd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb9a6d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb9a160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF5AC9168#\CF76DDAFEBD937C833368B4B58FAE120\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.CIMCMDLETS.NI.DLL" at base 7ffb58720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb57a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb8eca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffb57950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffb99fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffb90a40000 "powershell.exe" loaded module "MI.DLL" at base 7ffb8cca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffb8cfa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb8c5a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb8b9f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb992e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb8bc50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffb9abd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffb992e0000 "WMIC.exe" loaded module "KERNEL32" at base 7ffb9abd0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb992e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb992e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb992e0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb99df0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb992e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb992e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb992e0000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb61320000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ffb9aca0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb992e0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb8c5a0000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ffb98230000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ffb9abd0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffb89820000 "WMIC.exe" loaded module "USER32.DLL" at base 7ffb9a510000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb992e0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb965c0000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffb8ed10000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb990f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb8b9f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb992e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb992e0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb8bc50000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffb8b1e0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb8df60000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb8b160000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WLH9QTRH.DLL" at base 7ffb63c70000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb8b270000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffb8ecb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffb5faf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb5ee40000 "powershell.exe" loaded module "PSAPI.DLL" at base 232902c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffb5d880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffb5cc60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffb5c1d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb5fae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb5a150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb8ecb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb5a0b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb8ec90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb83390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb59f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb59e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb59550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb593e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffb58a50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb586e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb585b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb58540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb58460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb831a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 24d3ed30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb89b20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb87f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb5a010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb59760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb595f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb59480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffb58af0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb58780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb58650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb87f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb6de80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb87ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF5AC9168#\CF76DDAFEBD937C833368B4B58FAE120\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.CIMCMDLETS.NI.DLL" at base 7ffb585c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb578a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb89af0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffb577f0000 "powershell.exe" loaded module "PSAPI.DLL" at base 21b028e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb87f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb87ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb73690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb723f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb598a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb722b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffb58f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb6fdc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb72180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb857a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb730b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb87e80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF5AC9168#\CF76DDAFEBD937C833368B4B58FAE120\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.CIMCMDLETS.NI.DLL" at base 7ffb720f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb581f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffb72040000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffb9a780000 "powershell.exe" loaded module "PSAPI.DLL" at base 1c8afc00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb736c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb723f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb59c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb72280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffb6a8c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb72150000 "powershell.exe" loaded module "OLEAUT32" at base 7ffb9aaf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb59a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb58ce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffb720a0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffb91b0000060:Td10,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "pythoncom314.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pythoncom314.dll" was detected as "Microsoft Linker" and name: "Linker" "pywintypes314.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pywintypes314.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "stub.cp314-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "stub.cp314-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "win32ui.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32ui.pyd" was detected as "Microsoft Linker" and name: "Linker" "unicodedata.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ec_ws.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ec_ws.pyd" was detected as "Microsoft Linker" and name: "Linker" "_zstd.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_zstd.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "pyexpat.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pyexpat.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_cffi_backend.cp314-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_cffi_backend.cp314-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "win32file.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32file.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker"61:Taca,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS")62:T633,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "sqlite3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pythoncom314.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pywintypes314.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "stub.cp314-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32ui.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "unicodedata.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ec_ws.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_zstd.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pyexpat.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ssl.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_cffi_backend.cp314-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32file.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"63:T4fd,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has an executable section named ".text" "libcrypto-3.dll" has an executable section named ".text" "sqlite3.dll" has an executable section named ".text" "libssl-3.dll" has an executable section named ".text" "pythoncom314.dll" has an executable section named ".text" "pywintypes314.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named "fothk" "VCRUNTIME140_1.dll" has an executable section named ".text" "stub.cp314-win_amd64.pyd" has an executable section named ".text" "win32ui.pyd" has an executable section named ".text" "unicodedata.pyd" has an executable section named ".text" "_ec_ws.pyd" has an executable section named ".text" "_zstd.pyd" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "pyexpat.pyd" has an executable section named ".text" "_ssl.pyd" has an executable section named ".text" "_cffi_backend.cp314-win_amd64.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "win32file.pyd" has an executable section named ".text" "_ctypes.pyd" has an executable section named ".text"64:T50a,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has an writable section named ".data" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has an writable section named ".fptable" "libcrypto-3.dll" has an writable section named ".data" "sqlite3.dll" has an writable section named ".data" "libssl-3.dll" has an writable section named ".data" "pythoncom314.dll" has an writable section named ".data" "pywintypes314.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "stub.cp314-win_amd64.pyd" has an writable section named ".data" "win32ui.pyd" has an writable section named ".data" "unicodedata.pyd" has an writable section named ".data" "_ec_ws.pyd" has an writable section named ".data" "_zstd.pyd" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "pyexpat.pyd" has an writable section named ".data" "_ssl.pyd" has an writable section named ".data" "_cffi_backend.cp314-win_amd64.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "win32file.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data"65:T2a76,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000dc90,add rsp, 0x28,jmp 0x14000d8bc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000e324,test eax, eax,je 0x14000da7e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000da71,cmp rcx, rax,je 0x14000da85,xor eax, eax,lock cmpxchg qword ptr [rip + 0x378bc], rcx,jne 0x14000da6c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000da80,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x14000da9b," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x18036c4c8,jmp 0x1801ed120,jmp 0x18018f8e0,jmp 0x18021dd10,jmp 0x1802e9a10,jmp 0x1802bac50,jmp 0x18029c940,jmp 0x1802849c0,jmp 0x1800b30a0,jmp 0x1802edf50,jmp 0x1802722d0,jmp 0x1802467c0,jmp 0x18022c9c0,jmp 0x18022df70,jmp 0x18035d120,jmp 0x1800efa40,jmp 0x180294de0,jmp 0x18019b090,jmp 0x1801ec450,jmp 0x180210340," "sqlite3.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18013be95,call 0x18013beb4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18013bd4c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x31138],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18013bf4e," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x18007ea68,jmp 0x18001e370,jmp 0x180023fa0,jmp 0x1800095a0,jmp 0x180065a60,jmp 0x18002fb40,jmp 0x18007f458,jmp 0x180074d20,jmp 0x180012190,jmp 0x1800290c0,jmp 0x180037f70,jmp 0x18002d410,jmp 0x18001b6a0,jmp 0x180051e80,jmp 0x180024e70,jmp 0x180066390,jmp 0x18006e5c0,jmp 0x180013be0,jmp 0x18007f570,jmp 0x1800540b0," "pythoncom314.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18005df91,call 0x18005edd4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18005de24,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x308f],mov rcx, rbx,call qword ptr [rip + 0x308e],call qword ptr [rip + 0x3078],mov rcx, rax," "pywintypes314.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f35d,call 0x18000f8e8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f1f0,int3 ,int3 ,int3 ,jmp 0x18000f870,int3 ,int3 ,int3 ,lea rax, [rip + 0x3355],mov qword ptr [rcx + 0x10], 0,mov qword ptr [rcx], rax,mov rax, rcx,mov qword ptr [rcx + 8], rdx,ret ,int3 ,int3 ," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "stub.cp314-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18015dda5,call 0x18015df40,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18015dc5c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1253],mov rcx, rbx,call qword ptr [rip + 0x1242],call qword ptr [rip + 0x124c],mov rcx, rax," "win32ui.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180084685,call 0x180084f18,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180084518,int3 ,int3 ,int3 ,mov rax, rsp,mov qword ptr [rax + 8], rbx,mov qword ptr [rax + 0x10], rbp,mov qword ptr [rax + 0x18], rsi,mov qword ptr [rax + 0x20], rdi,push r14,sub rsp, 0x20,mov r10, qword ptr [r9 + 0x38],mov rsi, rdx,mov r14, r8," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002c65,call 0x180002e00,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002b1c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x33bb],mov rcx, rbx,call qword ptr [rip + 0x33ba],call qword ptr [rip + 0x33a4],mov rcx, rax," "_ec_ws.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018171,call 0x18001830c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001801c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xe7f],mov rcx, rbx,call qword ptr [rip + 0xe6e],call qword ptr [rip + 0xe78],mov rcx, rax," "_zstd.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001ec5,call 0x180001ee4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001d7c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x74108],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180001f7e," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180022431,call 0x180022450,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800222e8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1cb9c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1800224ea," "pyexpat.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180011035,call 0x1800111d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180010eec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x14003],mov rcx, rbx,call qword ptr [rip + 0x13fb2],call qword ptr [rip + 0x13fec],mov rcx, rax," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002f65,call 0x180002f84,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002e1c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1e068],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000301e," "_cffi_backend.cp314-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001b145,call 0x18001b164,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001affc,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0xde88],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18001b1fe," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013225,call 0x1800133c0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800130dc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3e0b],mov rcx, rbx,call qword ptr [rip + 0x3e0a],call qword ptr [rip + 0x3df4],mov rcx, rax," "win32file.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800140ad,call 0x18001477c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180013f40,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1ffb],mov rcx, rbx,call qword ptr [rip + 0x1ffa],call qword ptr [rip + 0x1fe4],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180007a55,call 0x180007bf0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000790c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc5d3],mov rcx, rbx,call qword ptr [rip + 0xc5c2],call qword ptr [rip + 0xc5cc],mov rcx, rax,"66:T47a,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" has high imagebase "0x140000000" "libcrypto-3.dll" has high imagebase "0x180000000" "sqlite3.dll" has high imagebase "0x180000000" "libssl-3.dll" has high imagebase "0x180000000" "pythoncom314.dll" has high imagebase "0x180000000" "pywintypes314.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "python3.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "stub.cp314-win_amd64.pyd" has high imagebase "0x180000000" "win32ui.pyd" has high imagebase "0x180000000" "unicodedata.pyd" has high imagebase "0x180000000" "_ec_ws.pyd" has high imagebase "0x180000000" "_zstd.pyd" has high imagebase "0x180000000" "_decimal.pyd" has high imagebase "0x180000000" "pyexpat.pyd" has high imagebase "0x180000000" "_ssl.pyd" has high imagebase "0x180000000" "_cffi_backend.cp314-win_amd64.pyd" has high imagebase "0x180000000" "_lzma.pyd" has high imagebase "0x180000000" "win32file.pyd" has high imagebase "0x180000000" "_ctypes.pyd" has high imagebase "0x180000000"67:T93f,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00001092-00000BC0-179429395] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00001092-00000BC0-179432851] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Ca" [Source: 00000000-00001092-00000C47-25978112612] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "wmic os get caption"" [Source: 00000000-00001092-00000C47-61386322400] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMod" [Source: 00000000-00001092-00000C47-92316025014] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_Operating" [Source: 00000000-00001092-00000C47-118422978822] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDi" [Source: 00000000-00001092-00000C47-149074630470] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -Expa" [Source: 00000000-00001092-00000C47-182101277038] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandPr" [Source: 00000000-00001092-00000C47-220587049068] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00003460-00000BC0-179569657] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003460-00000BC0-180703315] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003460-00000BC0-180705721] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\wbem\WMIC.exe" [Source: 00000000-00006872-00000BC0-195589125] Observed system executable string:"%WINDIR%\System32\Wbem\WMIC.exe" [Source: 00000000-00006872-00000BC0-195591495]68:T8d0,Process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00001092) was launched with new environment variables: "_PYI_ARCHIVE_FILE="C:\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe", USERDNSDOMAIN="DESKTOP-8LD9T6N", _PYI_APPLICATION_HOME_DIR="%TEMP%\_MEI49162", _PYI_PARENT_PROCESS_LEVEL="0"" Process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00001092) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003460) was launched with modified environment variables: "Path, _PYI_PARENT_PROCESS_LEVEL" Process "powershell.exe" (UID: 00000000-00005552) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00006872) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00009060) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005716) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00008740) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004136) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00003188) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001596) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00002752) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00008096) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00004544) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00008512) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00002260) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00000448) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00003096) was launched with new environment variables: "PROMPT="$P$G""69:T612,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")6a:Tfd4,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001092-00000C2B-177736398] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005552-00000C2B-181817540] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005552-00000C2B-182443669] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005552-00000C2B-182596473] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005552-00000C2B-182740290] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005552-00000C2B-183140523] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005552-00000C2B-183234320] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005552-00000C2B-183348064] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005552-00000C2B-183447430] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005552-00000C2B-183609990] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005552-00000C2B-183667943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005552-00000C2B-183764432] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005552-00000C2B-185278299] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005552-00000C2B-185468312] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005552-00000C2B-185990648] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005552-00000C2B-185993597] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005552-00000C2B-186640414] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005552-00000C2B-186659486] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005552-00000C2B-186718727] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005552-00000C2B-187196269] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005552-00000C2B-187379373] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005552-00000C2B-187890284] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005552-00000C2B-188003196] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005552-00000C2B-188403207] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005552-00000C2B-188480565]6b:T8a3,Spawned process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00001092) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get ..." (UID: 00000000-00003460) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Ci ..." (UID: 00000000-00005552) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00006872) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00009060) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00005716) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00008740) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$Exe ..." (UID: 00000000-00004136) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "$Execut ..." (UID: 00000000-00003188), Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00001596), Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Cim ..." (UID: 00000000-00002752) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00008096) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Cim ..." (UID: 00000000-00004544), Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00008512), Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpC ..." (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00000448) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpP ..." (UID: 00000000-00003096)6c:T8a3,Spawned process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00001092) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get ..." (UID: 00000000-00003460) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Ci ..." (UID: 00000000-00005552) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00006872) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00009060) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00005716) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00008740) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$Exe ..." (UID: 00000000-00004136) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "$Execut ..." (UID: 00000000-00003188), Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00001596), Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Cim ..." (UID: 00000000-00002752) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00008096) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Cim ..." (UID: 00000000-00004544), Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00008512), Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpC ..." (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get- ..." (UID: 00000000-00000448) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpP ..." (UID: 00000000-00003096)6d:T13e6,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O:LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "OOl:LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "stub.WinApi.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "Using cdll.LoadLibrary():" (Indicator: "LoadLibrary"; Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp")6e:T6ac3,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\python314.dll]- [targetUID: 00000000-00004916] "mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00004916] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libcrypto-3.dll]- [targetUID: 00000000-00004916] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\sqlite3.dll]- [targetUID: 00000000-00004916] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libssl-3.dll]- [targetUID: 00000000-00004916] "pythoncom314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pythoncom314.dll]- [targetUID: 00000000-00004916] "cacert.pem" has type "Unknown"- Location: [%TEMP%\_MEI49162\certifi\cacert.pem]- [targetUID: 00000000-00004916] "pywintypes314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pywintypes314.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140.dll]- [targetUID: 00000000-00004916] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI49162\python3.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004916] "stub.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\stub.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Jan 01 1980 00:00:00 uncompressed size 79001 method=store"- Location: [%TEMP%\_MEI49162\base_library.zip]- [targetUID: 00000000-00004916] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00004916] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\unicodedata.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_zstd.pyd]- [targetUID: 00000000-00004916] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_decimal.pyd]- [targetUID: 00000000-00004916] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\pyexpat.pyd]- [targetUID: 00000000-00004916] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ssl.pyd]- [targetUID: 00000000-00004916] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_lzma.pyd]- [targetUID: 00000000-00004916] "win32file.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32file.pyd]- [targetUID: 00000000-00004916] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ctypes.pyd]- [targetUID: 00000000-00004916] "win32security.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32security.pyd]- [targetUID: 00000000-00004916] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32api.pyd]- [targetUID: 00000000-00004916] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_sqlite3.pyd]- [targetUID: 00000000-00004916] "win32crypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32crypt.pyd]- [targetUID: 00000000-00004916] "md__mypyc.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\charset_normalizer\md__mypyc.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_bz2.pyd]- [targetUID: 00000000-00004916] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_socket.pyd]- [targetUID: 00000000-00004916] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\_asyncio.pyd]- [targetUID: 00000000-00004916] "_block.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\lz4\block\_block.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ed448.pyd]- [targetUID: 00000000-00004916] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00004916] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_hashlib.pyd]- [targetUID: 00000000-00004916] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00004916] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_curve448.pyd]- [targetUID: 00000000-00004916] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00004916] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_overlapped.pyd]- [targetUID: 00000000-00004916] "win32process.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32process.pyd]- [targetUID: 00000000-00004916] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_des.pyd]- [targetUID: 00000000-00004916] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00004916] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00004916] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00004916] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_wmi.pyd]- [targetUID: 00000000-00004916] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_multiprocessing.pyd]- [targetUID: 00000000-00004916] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_queue.pyd]- [targetUID: 00000000-00004916] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00004916] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00004916] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\select.pyd]- [targetUID: 00000000-00004916] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00004916] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Math\_modexp.pyd]- [targetUID: 00000000-00004916] "win32event.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32event.pyd]- [targetUID: 00000000-00004916] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_uuid.pyd]- [targetUID: 00000000-00004916] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA512.pyd]- [targetUID: 00000000-00004916] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA384.pyd]- [targetUID: 00000000-00004916] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00004916] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00004916] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00004916] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00004916] "win32trace.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32trace.pyd]- [targetUID: 00000000-00004916] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00004916] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00004916] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA256.pyd]- [targetUID: 00000000-00004916] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA224.pyd]- [targetUID: 00000000-00004916] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00004916] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00004916] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00004916] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00004916] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00004916] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00004916] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00004916] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00004916] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00004916] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00004916] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00004916] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA1.pyd]- [targetUID: 00000000-00004916] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00004916] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD5.pyd]- [targetUID: 00000000-00004916] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00004916] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_keccak.pyd]- [targetUID: 00000000-00004916] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00004916] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00004916] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00004916] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00004916] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00004916] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00004916] "_win32sysloader.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\_win32sysloader.pyd]- [targetUID: 00000000-00004916] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00004916] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00004916] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00004916] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD2.pyd]- [targetUID: 00000000-00004916] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD4.pyd]- [targetUID: 00000000-00004916] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00004916] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00004916] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00004916] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00004916] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00004916] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00004916] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00004916] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00004916] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_poly1305.pyd]- [targetUID: 00000000-00004916] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00004916] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00004916] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00004916] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_chacha20.pyd]- [targetUID: 00000000-00004916] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00004916] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00004916] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00004916] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00004916] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Protocol\_scrypt.pyd]- [targetUID: 00000000-00004916] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00004916] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00004916] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00004916] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00004916] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00004916] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00004916] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00004916] "_version.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\lz4\_version.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_ARC4.pyd]- [targetUID: 00000000-00004916] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00004916] "md.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\charset_normalizer\md.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Util\_strxor.pyd]- [targetUID: 00000000-00004916] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00004916] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Util\_cpuid_c.pyd]- [targetUID: 00000000-00004916] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00004916] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00004916] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00004916] "METADATA" has type "Unknown"- Location: [%TEMP%\_MEI49162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA]- [targetUID: 00000000-00004916] "METADATA" has type "Unknown"- Location: [%TEMP%\_MEI49162\lz4-4.4.5.dist-info\METADATA]- [targetUID: 00000000-00004916] "RECORD" has type "Unknown"- Location: [%TEMP%\_MEI49162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD]- [targetUID: 00000000-00004916] "bookmarks.txt" has type "Unknown"- [targetUID: N/A] "DESKTOP-8LD9T6N.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Jan 05 2026 21:38:38 uncompressed size 591 method=deflate"- [targetUID: N/A] "LICENSE" has type "Unknown"- Location: [%TEMP%\_MEI49162\lz4-4.4.5.dist-info\licenses\LICENSE]- [targetUID: 00000000-00004916] "history.txt" has type "Unknown"- [targetUID: N/A] "Lorem ipsum.txt" has type "Unknown"- Location: [%TEMP%\_MEI49162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt]- [targetUID: 00000000-00004916] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002260] "RECORD" has type "Unknown"- Location: [%TEMP%\_MEI49162\lz4-4.4.5.dist-info\RECORD]- [targetUID: 00000000-00004916] "downloads.txt" has type "Unknown"- [targetUID: N/A] "cookie.txt" has type "Unknown"- [targetUID: N/A] "__init__.py" has type "Unknown"- Location: [%TEMP%\gen_py\3.14\__init__.py]- [targetUID: 00000000-00001092] "WHEEL" has type "Unknown"- Location: [%TEMP%\_MEI49162\lz4-4.4.5.dist-info\WHEEL]- [targetUID: 00000000-00004916] "WHEEL" has type "Unknown"- Location: [%TEMP%\_MEI49162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL]- [targetUID: 00000000-00004916] "__PSScriptPolicyTest_rrbnqwnj.mz1.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_rrbnqwnj.mz1.psm1]- [targetUID: 00000000-00005552] "top_level.txt" has type "Unknown"- Location: [%TEMP%\_MEI49162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt]- [targetUID: 00000000-00004916] "dicts.dat" has type "Unknown"- Location: [%TEMP%\gen_py\3.14\dicts.dat]- [targetUID: 00000000-00001092] "top_level.txt" has type "Unknown"- Location: [%TEMP%\_MEI49162\lz4-4.4.5.dist-info\top_level.txt]- [targetUID: 00000000-00004916] "__PSScriptPolicyTest_f2yh3ks3.fn4.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_f2yh3ks3.fn4.ps1]- [targetUID: 00000000-00004544] "__PSScriptPolicyTest_x4p5zpax.0rj.ps1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_1iiqe5xf.e4p.ps1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_ytpuhgl3.w30.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_ytpuhgl3.w30.ps1]- [targetUID: 00000000-00005552] "__PSScriptPolicyTest_530ak5wl.2y2.ps1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_dr5bms2k.ww3.ps1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_ap0luiyh.252.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_ap0luiyh.252.ps1]- [targetUID: 00000000-00002260] "__PSScriptPolicyTest_baieujxo.mol.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_baieujxo.mol.ps1]- [targetUID: 00000000-00002752] "__PSScriptPolicyTest_1uaokju4.p5o.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_1uaokju4.p5o.ps1]- [targetUID: 00000000-00003188] "__PSScriptPolicyTest_qf20smgy.ito.psm1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_onzutegq.bci.psm1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_my4vouoo.lqt.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_my4vouoo.lqt.psm1]- [targetUID: 00000000-00003188] "__PSScriptPolicyTest_0uytsnzn.gec.psm1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_nhfeqjvc.3cb.psm1" has type "Unknown"- [targetUID: N/A] "__PSScriptPolicyTest_y02vu5rc.uax.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_y02vu5rc.uax.psm1]- [targetUID: 00000000-00002260] "__PSScriptPolicyTest_4ewgqpfc.1ne.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_4ewgqpfc.1ne.psm1]- [targetUID: 00000000-00004544] "__PSScriptPolicyTest_5k5otcbr.rry.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_5k5otcbr.rry.psm1]- [targetUID: 00000000-00002752]6f:T93d,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "")70:T6b0,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\python314.dll]- [targetUID: 00000000-00004916] "mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00004916] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libcrypto-3.dll]- [targetUID: 00000000-00004916] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\sqlite3.dll]- [targetUID: 00000000-00004916] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libssl-3.dll]- [targetUID: 00000000-00004916] "pythoncom314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pythoncom314.dll]- [targetUID: 00000000-00004916] "pywintypes314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pywintypes314.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140.dll]- [targetUID: 00000000-00004916] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI49162\python3.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004916]71:T113b,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "55790767E48D39D71BF0814BA9AB4BD294DE825CCAB8B01CFA854399E2E935C8"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "")72:T93c,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\System32\imm32.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "\Global??\FltMgrMsg" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\VCRUNTIME140.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\VCRUNTIME140_1.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140_1.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_ARC4.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher"73:Td7e,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\VCRUNTIME140.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\VCRUNTIME140_1.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\libcrypto-3.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\libffi-8.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\libssl-3.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\python3.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\python314.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\pywin32_system32\pywintypes314.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\sqlite3.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\ucrtbase.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\VERSION.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\bcrypt.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\IPHLPAPI.DLL" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\pywin32_system32\IPHLPAPI.DLL" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\PROPSYS.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\PROPSYS.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\pywin32_system32\PROPSYS.dll" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\win32\pywintypes314.dll"74:T11b1,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_Salsa20.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_chacha20.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_pkcs1_decode.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_aes.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_aesni.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_arc2.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_blowfish.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cast.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cbc.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cfb.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ctr.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_des.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_des3.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ecb.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_eksblowfish.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ocb.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ofb.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_BLAKE2s.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD2.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD4.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD5.pyd" "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_RIPEMD160.pyd"75:T6e0,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")76:T163c,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") file/memory contains long string with (Indicator: " bind "; File: "LICENSE") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "can't send non-None value to a just-started coroutine" (Indicator: " send "; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "can't send non-None value to a just-started generator" (Indicator: " send "; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "send(arg) -> send 'arg' into generator," (Indicator: " send "; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "send(arg) -> send 'arg' into coroutine," (Indicator: " send "; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found reference to API "threading shutdown instead of interpreter shutdown." (Indicator: " shutdown "; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found reference to API "This module allows you to spawn processes, connect to their" (Indicator: " connect "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "*reuse_port* dictates whether to use the SO_REUSEPORT socket option." (Indicator: " socket "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " socket "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " accept "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "``__init__`` methods that accept ``id`` and ``name``." (Indicator: " accept "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "Cannot send input after starting communication" (Indicator: " send "; Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp") Found reference to API "Interact with process: Send data to stdin and close it." (Indicator: " send "; Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp")77:T2059,Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "hx.aq" Heuristic match: "xl.gq" Heuristic match: "kp>.ai" Heuristic match: "/k.mr" Heuristic match: "qx`.by" Heuristic match: "hg&.bh" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "t.hm/h;tzh9]t$hh\$@hl$8hl$" Pattern match: "www.memtest86.com" Pattern match: "http://www.apache.org/licenses/" Pattern match: "https://github.com/python/importlib_metadataclassifier" Pattern match: "https://github.com/python-lz4/python-lz4author" Pattern match: "https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global" Pattern match: "https://www.mozilla.org/en-us/firefox/120.0.1/whatsnew/?oldversion=119.0&utm_medium=firefox-desktop&utm_source=update&utm_campaign=120&v=2" Pattern match: "https://github.com/coreybutler/nvm-windows/releases/tag/1.1.12" Heuristic match: "ip-api.com" Heuristic match: "github.com" Heuristic match: "%windir%\system32\cmd.exe /c powershell -noprofile -executionpolicy bypass -command (get-ciminstance win32_operatingsystem).ca" Heuristic match: "= 'disableblockatfirstseen'; parametertype = 'system.boolean'; bindings = 'in'; value = $__cmdletization_defaultvalue; isvaluepresent = $__cmdletization_defaultvalueispresent} } $__cmdletization_methodparameters.add($__cmdletization_methodpar" Heuristic match: "fp.cf" Heuristic match: "%q.tk" Pattern match: "https://www.openssl.org/" Heuristic match: "struct.py" Pattern match: "myimport.zip/mydirectory" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.metapathfinder.invalidate_caches" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.executionloader.get_filename" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.exec_module" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_code" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.is_package" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.pathentryfinder.find_spec" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_source" Heuristic match: "__init__.py" Pattern match: "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py#l679-l688" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.create_module" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.resourceloader.get_data" Pattern match: "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#l24-l25" Pattern match: "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#l81-l97" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py#l11" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l422" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l312" Heuristic match: "\__init__.py" Heuristic match: "encodings\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\importlib\machinery.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\ctypes\__init__.py" Heuristic match: "encodings\_win_cp_codecs.py" Heuristic match: "glob.py" Heuristic match: "encodings\aliases.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "52.py" Heuristic match: "c:\struct.py" Heuristic match: "pyimod01_archive.py" Heuristic match: "c:\pyimod01_archive.py" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "c:\pyimod02_importers.py" Heuristic match: "pyimod02_importers.py" Heuristic match: "pyimod03_ctypes.py" Heuristic match: "c:\pyimod03_ctypes.py" Heuristic match: "pyimod04_pywin32.py" Heuristic match: "c:\pyimod04_pywin32.py" Heuristic match: "pyiboot01_bootstrap.py" Heuristic match: "charset_normalizer.cd" Heuristic match: "windows.com" Heuristic match: "ctypes\__init__.py" Heuristic match: "sysconfig\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\sysconfig\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\threading.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\ctypes\_endian.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\ctypes\util.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\fnmatch.py" Pattern match: "tar.gz/tar.bz2/tar.xz/tar.zst" Heuristic match: "threading.py" Heuristic match: "thread.name" Heuristic match: "it__.py" Heuristic match: "_weakrefset.py" Heuristic match: "types.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\shutil.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\bz2.py" Heuristic match: "ctypes\_endian.py" Heuristic match: "ctypes\util.py" Heuristic match: "pyi_rth_inspect.py" Heuristic match: "libm.so" Heuristic match: "enum.py" Heuristic match: "librpm.so" Heuristic match: "libcrypt.so" Heuristic match: "shutil.py" Heuristic match: "fnmatch.py" Heuristic match: "functools.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\compression\_common\_streams.py" Heuristic match: "pc:\users\hapubws\appdata\local\temp\_mei49162\compression\_common\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\compression\zstd\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\compression\zstd\_zstdfile.py" Heuristic match: "pythonpath=tools/peg_generator python3 -m pegen.keywordgen grammar/python.gram grammar/tokens lib/keyword.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\posixpath.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\compression\__init__.py" Pattern match: "https://docs.python.org/3/howto/mro.html" Heuristic match: "collections\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\lzma.py" Heuristic match: "keyword.py" Heuristic match: "operator.py" Heuristic match: "reprlib.py" Heuristic match: "re\__init__.py" Heuristic match: "bz2.py" Heuristic match: "enum.name" Heuristic match: "{fnumerattextwrap.py" Heuristic match: "re\_compiler.py" Heuristic match: "t__.py" Heuristic match: "re\_parser.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei49162\signal.py" Heuristic match: "re\_constants.py" Heuristic match: ">>> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> path.name" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Pattern match: "https://developer.android.com/tools/releases/platforms" Pattern match: "https://developer.android.com/ndk/guides/abis" Pattern match: "https://packaging.python.org/en/latest/specifications/entry-points/#file-format" Pattern match: "https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file" Pattern match: "https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the-project-table" Pattern match: "https://github.com/python/cpython/issues/86361"78:T169d2,Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001092.00000000.75049.60652000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/tools/releases/platforms>" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/ndk/guides/abis>" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001092.00000000.75049.CD2F0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00001092.00000000.75049.CD3F0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)hf-a" - Source: "00000000-00001092.00000000.75049.CD4F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001092.00000000.75049.CD4F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymldistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001092.00000000.75049.CD4F0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577916/>" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "https://www.python.org/')d'uurewtbexuudiuudauud" - Source: "00000000-00001092.00000000.75049.CD655000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001092.00000000.75049.CD77E000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001092.00000000.75049.CD77E000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00001092.00000000.75049.CD77E000.00000004.mdmp") Found URL "http://87.248.157.152:5000http://ip-api.com/jsonhttp://ip-api.com/line/?fields=hostinghttpbin.orghttps://https://api.ipify.orghttps://cdn.discordapp.com/avatars/https://cdn.discordapp.com/embed/avatars/https://cdn.discordapp.com/embed/avatars/0.pnghttps://cdn.discordapp.com/emojis/https://checkip.amazonaws.comhttps://discord.com/assets/f9bb9c4af2b9c32e2c5ee0014661546d.pnghttps://discordapp.com/api/v6/users/@mehttps://discordapp.com/api/v9/users/@mehttps://github.com/claudexwq/-njection/raw/refs/heads/main/chromelevator_x64.exehttps://httpbin.org/iphttps://ipapi.co/json/https://ipinfo.io/jbtq&;wu&" - Source: "00000000-00001092.00000000.75049.CD77E000.00000004.mdmp") Found URL "http://87.248.157.152:5000http://ip-api.com/jsonhttp://ip-api.com/line/?fields=hostinghttpbin.orghttps://https://api.ipify.orghttps://cdn.discordapp.com/avatars/https://cdn.discordapp.com/embed/avatars/https://cdn.discordapp.com/embed/avatars/0.pnghttps://cdn.discordapp.com/emojis/https://checkip.amazonaws.comhttps://discord.com/assets/f9bb9c4af2b9c32e2c5ee0014661546d.pnghttps://discordapp.com/api/v6/users/@mehttps://discordapp.com/api/v9/users/@mehttps://github.com/claudexwq/-njection/raw/refs/heads/main/chromelevator_x64.exehttps://httpbin.org/iphttps://i8t,acgamesl" - Source: "00000000-00001092.00000000.75049.CD77E000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001092.00000000.75049.CD888000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/see_urlformat_args" - Source: "00000000-00001092.00000000.75049.CD888000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001092.00000000.75049.CD888000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001092.00000000.75049.CD9F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.set" - Source: "00000000-00001092.00000000.75049.CD9F0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5d%uuwrap" - Source: "00000000-00001092.00000000.75049.CD9F0000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001092.00000000.75049.CD9F0000.00000004.mdmp") Found URL "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaelf" - Source: "00000000-00001092.00000000.75049.CDAF0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmldetect" - Source: "00000000-00001092.00000000.75049.CDAF0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.xy,agiven" - Source: "00000000-00001092.00000000.75049.CDAF0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\hapubws\appdata\local\temp\_mei49162\setuptools\_distutils\log.pyx:-ah0-ahf-a(:-adistutils.log.log" - Source: "00000000-00001092.00000000.75049.CDAF0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00001092.00000000.75049.CDAF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expression@o-adistribution._finalize_license_filesh" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "http://foo/bar.tar.gz')>>>" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "http://foo/bar.tgz')>>>" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "http://socks" - Source: "00000000-00001092.00000000.75049.CDBF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001092.00000000.75049.CDCF0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptoolswarning._format@o-ajson" - Source: "00000000-00001092.00000000.75049.CDDF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001092.00000000.75049.CDDF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001092.00000000.75049.CDDF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001092.00000000.75049.CDDF0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/x0-a_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlh[-astaticmodule.__getattr__glob_relative..hf-astrpath" - Source: "00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_points_configexpander._obtain_classifiers_configexpander._obtain_dependenciesoptional_dependencies_maptool_table_correspondence_ensurepackagesdiscovered.__annotate___ensurepackagesdiscovered.__init__@o-aqf.chrome_time_to_unix_epochoad)xt,axt,axt,axt,axt,ax0-axt,axt,ap3-axt,axt,awraps" - Source: "00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/c:\windows\system32\wbem\wmic.exedescription-content-typee4082800-3b00-11ea-8000-3cecef43ff78<:early_supporter:1442810760081178634>hkf(\google\chrome\user" - Source: "00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp") Found URL "http://87.248.157.152:5000http://ip-api.com/line/?fields=hostinghttps://cdn.discordapp.com/avatars/https://cdn.discordapp.com/emojis/https://checkip.amazonaws.comacbdhttps://discordapp.com/api/v6/users/@mehttps://discordapp.com/api/v9/users/@me<:hypesquadevents:1442810780717158431>launcher_accounts_microsoft_store.json<:legacy_username:1442810478207434813><:mastercard:1443002789994434580><:nitro:1442810362587250729><:nitro_1m:1442810435014496336><:nitro_1y:1442810744696606720><:nitro_2m:1442810642032627814>o+t;<:nitro_2y:1442810314541367296><:nitro_3m:1442810642032627814><:nitro_3y:1442810549523054676><:nitro_5y:1442810457978044458><:nitro_6m:1442810711813263391><:nitro_6y:1442810457978044458><:paypal:1443002855328972891><:pomelo:1442810584276930614>[dvmd<:quest:1442810520808722473>run_chromelevator_all.bat<:staff:1381771492492054709><:visa:1443002879051956294>antivm.check_if_running_in_vmantivm.check_ps_environmentantivm.check_screen_sizeantivm.is_blacklisted_gpuantivm.is_blacklisted_hostnameantivm.is_blacklisted_hwidantivm.is_blacklisted_ipantivm.is_blacklisted_macantivm.is_blacklisted_osantivm.is_blacklisted_product_keyantivm.is_blacklisted_usernamedb" - Source: "00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic).pyd" - Source: "00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/hf-ax_-aqhf-ahf-axt,a_cython_3_2_1.generator_cython_3_2_1.coroutine_cython_3_2_1.coroutine_wrapper@xx" - Source: "00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp") Found URL "https://cdn.discordapp.com/embed/avatars/https://cdn.discordapp.com/embed/avatars/0.png\.lunarclient\settings\game\accounts.jsonreg" - Source: "00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp") Found URL "https://discord.com/assets/f9bb9c4af2b9c32e2c5ee0014661546d.pngpowershell" - Source: "00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp") Found URL "http://ip-api.com/jsonhttpbin.orghttps://https://api.ipify.orghttps://httpbin.org/iphttps://ipapi.co/json/https://ipinfo.io/jsonn]61ex" - Source: "00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00001092.00000001.76969.60A18000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00001092.00000001.76969.8B193000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/tools/releases/platforms>" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/ndk/guides/abis>" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-108r1.pdf>" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001092.00000001.76969.CD2F0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)hf-a" - Source: "00000000-00001092.00000001.76969.CD4F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001092.00000001.76969.CD4F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymldistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001092.00000001.76969.CD4F0000.00000004.mdmp") Found URL "http://www.opensource.org/licenses/mit-license.phpfor" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577916/>" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366890%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "https://www.python.org/')d'uurewtbexuudiuudauud" - Source: "00000000-00001092.00000001.76969.CD5F0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001092.00000001.76969.CD9F0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.set" - Source: "00000000-00001092.00000001.76969.CD9F0000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5d%uuwrap" - Source: "00000000-00001092.00000001.76969.CD9F0000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001092.00000001.76969.CD9F0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptoolswarning._format@o-ajson" - Source: "00000000-00001092.00000001.76969.CDDF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001092.00000001.76969.CDDF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001092.00000001.76969.CDDF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001092.00000001.76969.CDDF0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/x0-a_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlh[-astaticmodule.__getattr__glob_relative..hf-astrpath" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686735(v=vs.85).aspxprovides" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_points_configexpander._obtain_classifiers_configexpander._obtain_dependenciesoptional_dependencies_maptool_table_correspondence_ensurepackagesdiscovered.__annotate___ensurepackagesdiscovered.__init__@o-aqf.chrome_time_to_unix_epochoad)wraps" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa379560(v=vs.85).aspxinject" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms682489%28v=vs.85%29.aspxhttps://msdn.microsoft.com/en-us/library/windows/desktop/ms684834%28v=vs.85%29.aspxreturns-------list[processentry32]" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686735(v=vs.85).aspxthe" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspxx]-ax%-axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,a0r" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/c:\windows\system32\wbem\wmic.exedescription-content-typee4082800-3b00-11ea-8000-3cecef43ff78<:early_supporter:1442810760081178634>hkf(\google\chrome\user" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "http://87.248.157.152:5000http://ip-api.com/line/?fields=hostinghttps://cdn.discordapp.com/avatars/https://cdn.discordapp.com/emojis/https://checkip.amazonaws.comacbdhttps://discordapp.com/api/v6/users/@mehttps://discordapp.com/api/v9/users/@me<:hypesquadevents:1442810780717158431>launcher_accounts_microsoft_store.json<:legacy_username:1442810478207434813><:mastercard:1443002789994434580><:nitro:1442810362587250729><:nitro_1m:1442810435014496336><:nitro_1y:1442810744696606720><:nitro_2m:1442810642032627814>o+t;<:nitro_2y:1442810314541367296><:nitro_3m:1442810642032627814><:nitro_3y:1442810549523054676><:nitro_5y:1442810457978044458><:nitro_6m:1442810711813263391><:nitro_6y:1442810457978044458><:paypal:1443002855328972891><:pomelo:1442810584276930614>[dvmd<:quest:1442810520808722473>run_chromelevator_all.bat<:staff:1381771492492054709><:visa:1443002879051956294>antivm.check_if_running_in_vmantivm.check_ps_environmentantivm.check_screen_sizeantivm.is_blacklisted_gpuantivm.is_blacklisted_hostnameantivm.is_blacklisted_hwidantivm.is_blacklisted_ipantivm.is_blacklisted_macantivm.is_blacklisted_osantivm.is_blacklisted_product_keyantivm.is_blacklisted_usernamedb" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic).pyd" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms724958(v=vs.85).aspxe.uu" - Source: "00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespaceillegal" - Source: "00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp") Found URL "http://www.tarsnap.com/scrypt/scrypt-slides.pdfr" - Source: "00000000-00001092.00000001.76969.CE2D3000.00000004.mdmp") Found URL "ftp://dkuug.dk/i18n/charmaps/hp-roman8" - Source: "00000000-00001092.00000001.76969.CE2D3000.00000004.mdmp") Found URL "https://www.ietf.org/rfc/rfc2898.txt>" - Source: "00000000-00001092.00000001.76969.CE2D3000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376086(v=vs.85).aspx>" - Source: "00000000-00001092.00000001.76969.CE2D3000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/hf-ax_-ap3-apo-ahf-axt,a_cython_3_2_1.generator_cython_3_2_1.coroutine_cython_3_2_1.coroutine_wrapper@xx" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://cdn.discordapp.com/embed/avatars/https://cdn.discordapp.com/embed/avatars/0.png\.lunarclient\settings\game\accounts.jsonreg" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://discord.com/assets/f9bb9c4af2b9c32e2c5ee0014661546d.pngpowershell" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "http://ip-api.com/jsonhttpbin.orghttps://https://api.ipify.orghttps://httpbin.org/iphttps://ipapi.co/json/https://ipinfo.io/jsonn]61ex" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/ru-ru/library/windows/desktop/ms682633(v=vs.85).aspx(l-a0a-a" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspxcloses" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms724211%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684225%28v=vs.85%29.aspxreturns" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684839(v=vs.85).aspxx" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684229(v=vs.85).aspxxt,axt,axu,ah--axt,axt,axt,awrite" - Source: "00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms682633(v=vs.85).aspxhttps://msdn.microsoft.com/en-us/library/windows/desktop/ms683196(v=vs.85).aspxparameters----------handle:" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/ru-ru/library/windows/desktop/ms682633(v=vs.85).aspxdescribes" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684225%28v=vs.85%29.aspxt" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspxt" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms724958(v=vs.85).aspxschedule" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa379560(v=vs.85).aspxprepare" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684335%28v=vs.85%29.aspxparameters----------thread_id:" - Source: "00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00001092.00000001.76969.CE9F0000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.same" - Source: "00000000-00001092.00000001.76969.CE9F0000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.the" - Source: "00000000-00001092.00000001.76969.CE9F0000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764.>>>" - Source: "00000000-00001092.00000001.76969.CE9F0000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875.see:" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539d>uuput" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__annotate__headerparsingerror.__init__raised" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290@o-a(:-a@o-a@o-ah" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920r!r" - Source: "00000000-00001092.00000001.76969.CEAF0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001092.00000001.76969.CEBF0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001092.00000001.76969.CEBF0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001092.00000001.76969.CEBF0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001092.00000001.76969.CEBF0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001092.00000001.76969.CEBF0000.00000004.mdmp") Found URL "https://www.ietf.org/rfc/rfc2898.txt>" - Source: "00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5869too" - Source: "00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/wbemcli/nf-wbemcli-iwbemservices-createinstanceenum" - Source: "00000000-00001092.00000001.76969.CFD0B000.00000004.mdmp") Found URL "https://www.ietf.orc2898.txt>" - Source: "00000000-00001092.00000001.76969.D00A5000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297^at" - Source: "00000000-00001092.00000001.76969.D00A5000.00000004.mdmp") Found URL "http://www.tarsnap.com/scrypt/scrypt-slides.pdfn" - Source: "00000000-00001092.00000001.76969.D00A5000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5869xt-axt-axt-axt-axt-axt-axt-axt-axt-axt-axt-axt-axt-axt-ad" - Source: "00000000-00001092.00000001.76969.D040D000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/winnt/ne-winnt-_token_information_class>" - Source: "00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://hakril.github.io/pythonforwindows/build/html/sample.html" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/wbemcli/nf-wbemcli-iwbemservices-createclassenumreturn" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)c:\users\hapubws\appdata\local\temp\_mei49162\windows\winobject\__pycache__\event_trace.cpython-314.pycdefines" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-trace_provider_instance_info)@r" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/winnt/ne-winnt-_token_information_class>" - Source: "00000000-00001092.00000001.76969.D0DE0000.00000004.mdmp") Found URL "https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html>" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/hh877860.aspx:type:" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/sddl/nf-sddl-convertstringsecuritydescriptortosecuritydescriptora>" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/wmisdk/wmi-system-propertiesd!uuw" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/devprivate-resource)abstract" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)represent" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties)this" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385784(v=vs.85).aspx8u,axu,axu,a8v,axv,apython" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/devprivate-resource)c:\users\hapubws\appdata\local\temp\_mei49162\windows\winobject\handle.pybject)a" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa362823(v=vs.85).aspx>return" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspxidentifies" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx>" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupdigetdeviceregistrypropertya" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380252(v=vs.85).aspx" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)p3-acheck" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-trace_provider_instance_info)p3-areturn" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspxopen" - Source: "00000000-00001092.00000001.76969.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380264(v=vs.85).aspx>" - Source: "00000000-00001092.00000001.76969.D10E0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespacehttp://www.w3.org/2000/xmlns/http://www.w3.org/1999/xhtmlregisterdomimplementationclass" - Source: "00000000-00001092.00000001.76969.D10E0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issueserror_package_lacks_capability_for_mandatory_startuptasksonederror_graphics_vail_failed_to_send_create_superwetink_messageerror_graphics_vail_failed_to_send_destroy_superwetink_messageerror_graphics_vail_failed_to_send_composition_window_dpi_messagevm_saved_state_dump_e_nested_virtualization_not_supportedm_valuec:\users\hapubws\appdata\local\temp\_mei49162\win32com\client\build.pyabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789_" - Source: "00000000-00001092.00000001.76969.D11E0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297(y-a(y-areturn" - Source: "00000000-00001092.00000001.76969.D11E0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297p3-axt,axt,axt,axv,axv,axv,axt,axt,axt,axt,a" - Source: "00000000-00001092.00000001.76969.D11E0000.00000004.mdmp") Found URL "https://github.com/borisbabic/browser_cookie3/issues/new22621thread-20r" - Source: "00000000-00001092.00000001.76969.D11E0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001092.00000002.78890.5FF86000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/tools/releases/platforms>" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://developer.android.com/ndk/guides/abis>" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-108r1.pdf>" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001092.00000002.78890.CD2F0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00001092.00000002.78890.CD3F0000.00000004.mdmp") Found URL "http://www.opensource.org/licenses/mit-license.phpfor" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577916/>" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366890%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://www.python.org/')d'uurewtbexuudiuudauud" - Source: "00000000-00001092.00000002.78890.CD5F0000.00000004.mdmp") Found URL "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaelf" - Source: "00000000-00001092.00000002.78890.CDAF0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmldetect" - Source: "00000000-00001092.00000002.78890.CDAF0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.xy,agiven" - Source: "00000000-00001092.00000002.78890.CDAF0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\hapubws\appdata\local\temp\_mei49162\setuptools\_distutils\log.pyx:-ah0-ahf-a(:-adistutils.log.log" - Source: "00000000-00001092.00000002.78890.CDAF0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00001092.00000002.78890.CDAF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expression@o-adistribution._finalize_license_filesh" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "http://foo/bar.tar.gz')>>>" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "http://foo/bar.tgz')>>>" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "http://socks" - Source: "00000000-00001092.00000002.78890.CDBF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001092.00000002.78890.CDCF0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/x0-a_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlh[-astaticmodule.__getattr__glob_relative..hf-astrpath" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686735(v=vs.85).aspxprovides" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_points_configexpander._obtain_classifiers_configexpander._obtain_dependenciesoptional_dependencies_maptool_table_correspondence_ensurepackagesdiscovered.__annotate___ensurepackagesdiscovered.__init__@o-aqf.chrome_time_to_unix_epochoad)wraps" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa379560(v=vs.85).aspxinject" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms682489%28v=vs.85%29.aspxhttps://msdn.microsoft.com/en-us/library/windows/desktop/ms684834%28v=vs.85%29.aspxreturns-------list[processentry32]" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686735(v=vs.85).aspxthe" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspxx]-ax%-axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,axt,a0r" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/c:\windows\system32\wbem\wmic.exedescription-content-typee4082800-3b00-11ea-8000-3cecef43ff78<:early_supporter:1442810760081178634>hkf(\google\chrome\user" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "http://87.248.157.152:5000http://ip-api.com/line/?fields=hostinghttps://cdn.discordapp.com/avatars/https://cdn.discordapp.com/emojis/https://checkip.amazonaws.comacbdhttps://discordapp.com/api/v6/users/@mehttps://discordapp.com/api/v9/users/@me<:hypesquadevents:1442810780717158431>launcher_accounts_microsoft_store.json<:legacy_username:1442810478207434813><:mastercard:1443002789994434580><:nitro:1442810362587250729><:nitro_1m:1442810435014496336><:nitro_1y:1442810744696606720><:nitro_2m:1442810642032627814>o+t;<:nitro_2y:1442810314541367296><:nitro_3m:1442810642032627814><:nitro_3y:1442810549523054676><:nitro_5y:1442810457978044458><:nitro_6m:1442810711813263391><:nitro_6y:1442810457978044458><:paypal:1443002855328972891><:pomelo:1442810584276930614>[dvmd<:quest:1442810520808722473>run_chromelevator_all.bat<:staff:1381771492492054709><:visa:1443002879051956294>antivm.check_if_running_in_vmantivm.check_ps_environmentantivm.check_screen_sizeantivm.is_blacklisted_gpuantivm.is_blacklisted_hostnameantivm.is_blacklisted_hwidantivm.is_blacklisted_ipantivm.is_blacklisted_macantivm.is_blacklisted_osantivm.is_blacklisted_product_keyantivm.is_blacklisted_usernamedb" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic).pyd" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms724958(v=vs.85).aspxe.uu" - Source: "00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385352(v=vs.85).aspx)get_valueslen)namekwargsvaluess" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000002.78890.CDFF0000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespaceillegal" - Source: "00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp") Found URL "http://www.tarsnap.com/scrypt/scrypt-slides.pdfr" - Source: "00000000-00001092.00000002.78890.CE2D3000.00000004.mdmp") Found URL "ftp://dkuug.dk/i18n/charmaps/hp-roman8" - Source: "00000000-00001092.00000002.78890.CE2D3000.00000004.mdmp") Found URL "https://www.ietf.org/rfc/rfc2898.txt>" - Source: "00000000-00001092.00000002.78890.CE2D3000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376086(v=vs.85).aspx>" - Source: "00000000-00001092.00000002.78890.CE2D3000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/hf-ax_-ap3-apo-ahf-axt,a_cython_3_2_1.generator_cython_3_2_1.coroutine_cython_3_2_1.coroutine_wrapper@xx" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://cdn.discordapp.com/embed/avatars/https://cdn.discordapp.com/embed/avatars/0.png\.lunarclient\settings\game\accounts.jsonreg" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://discord.com/assets/f9bb9c4af2b9c32e2c5ee0014661546d.pngpowershell" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "http://ip-api.com/jsonhttpbin.orghttps://https://api.ipify.orghttps://httpbin.org/iphttps://ipapi.co/json/https://ipinfo.io/jsonn]61ex" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/ru-ru/library/windows/desktop/ms682633(v=vs.85).aspx(l-a0a-a" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspxcloses" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms724211%28v=vs.85%29.aspxparameters----------handle:" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684225%28v=vs.85%29.aspxreturns" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684839(v=vs.85).aspxx" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms684229(v=vs.85).aspxxt,axt,axu,ah--axt,axt,axt,awrite" - Source: "00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875.see:" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539d>uuput" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__annotate__headerparsingerror.__init__raised" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290@o-a(:-a@o-a@o-ah" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920r!r" - Source: "00000000-00001092.00000002.78890.CEAF0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001092.00000002.78890.CEBF0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001092.00000002.78890.CEBF0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001092.00000002.78890.CEBF0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001092.00000002.78890.CEBF0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001092.00000002.78890.CEBF0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found URL "http://hooksmountkwargsargs" - Source: "00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found URL "https://requests.readthedocs.iorequests._internal_utilsp,ofrequests\_internal_utils.pyxt,ah--a_valid_header_name_re_byteh--a_valid_header_name_re_str_valid_header_value_re_byte_valid_header_value_re_strxt,axt,axt,amockrequest.get_origin_req_hostmockrequest.get_full_urlmockrequest.is_unverifiable@" - Source: "00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found URL "https://ct__session.__init__session.__enter__session.__exit__merged_cookiesprepare_requestsession.prepare_requestsettingssend_kwargs" - Source: "00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found URL "https://p.-ax%-astreamed" - Source: "00000000-00001092.00000002.78890.CED10000.00000004.mdmp") Found URL "https://www.ietf.org/rfc/rfc2898.txt>" - Source: "00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5869too" - Source: "00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/wbemcli/nf-wbemcli-iwbemservices-createinstanceenum" - Source: "00000000-00001092.00000002.78890.CFD0B000.00000004.mdmp") Found URL "https://www.ietf.orc2898.txt>" - Source: "00000000-00001092.00000002.78890.D00A5000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297^at" - Source: "00000000-00001092.00000002.78890.D00A5000.00000004.mdmp") Found URL "http://www.tarsnap.com/scrypt/scrypt-slides.pdfn" - Source: "00000000-00001092.00000002.78890.D00A5000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtokena" - Source: "00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/winnt/ne-winnt-_token_information_class>" - Source: "00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupdigetdeviceregistrypropertya" - Source: "00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/winnt/ns-winnt-_token_mandatory_policy>" - Source: "00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/hardware-resources" - Source: "00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385352(v=vs.85).aspx)h&-a" - Source: "00000000-00001092.00000002.78890.D0EE0000.00000004.mdmp") Found URL "https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html>" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/hh877860.aspx:type:" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/api/sddl/nf-sddl-convertstringsecuritydescriptortosecuritydescriptora>" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/desktop/wmisdk/wmi-system-propertiesd!uuw" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/devprivate-resource)abstract" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)represent" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties)this" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385784(v=vs.85).aspx8u,axu,axu,a8v,axv,apython" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/devprivate-resource)c:\users\hapubws\appdata\local\temp\_mei49162\windows\winobject\handle.pybject)a" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa362823(v=vs.85).aspx>return" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspxidentifies" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx>" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupdigetdeviceregistrypropertya" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380252(v=vs.85).aspx" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_publisher_metadata_property_id)p3-acheck" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-trace_provider_instance_info)p3-areturn" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspxopen" - Source: "00000000-00001092.00000002.78890.D0FE0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380264(v=vs.85).aspx>" - Source: "00000000-00001092.00000002.78890.D10E0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespacehttp://www.w3.org/2000/xmlns/http://www.w3.org/1999/xhtmlregisterdomimplementationclass" - Source: "00000000-00001092.00000002.78890.D10E0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issueserror_package_lacks_capability_for_mandatory_startuptasksonederror_graphics_vail_failed_to_send_create_superwetink_messageerror_graphics_vail_failed_to_send_destroy_superwetink_messageerror_graphics_vail_failed_to_send_composition_window_dpi_messagevm_saved_state_dump_e_nested_virtualization_not_supportedm_valuec:\users\hapubws\appdata\local\temp\_mei49162\win32com\client\build.pyabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789_" - Source: "00000000-00001092.00000002.78890.D11E0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297(y-a(y-areturn" - Source: "00000000-00001092.00000002.78890.D11E0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc5297p3-axt,axt,axt,axv,axv,axv,axt,axt,axt,axt,apowershell" - Source: "00000000-00001092.00000002.78890.D11E0000.00000004.mdmp") Found URL "https://github.com/borisbabic/browser_cookie3/issues/new22621thread-20r" - Source: "00000000-00001092.00000002.78890.D11E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn:k%[" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://anonymously" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00002260.00000001.80606.C9D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&k'" - Source: "00000000-00002260.00000001.80606.C9FC4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/doc&v$" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4bgnvbactwashington1redmond1microsoft" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "https://go.micros@fwlink/?linkid=623636" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://www.microsoft.co/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "http://crl.micro/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microocera06-23.crt0fg:smxsu$was.,k" - Source: "00000000-00002260.00000001.80606.C9FF6000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0010130002.16.8400q01013000680,7386,7680,3,th32(1>" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002752.00000001.78699.590B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f0ymswbx6syy'q\y-g" - Source: "00000000-00002752.00000001.78699.5917C000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002752.00000001.78699.591B0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.1washington1redmond1microsoft" - Source: "00000000-00002752.00000001.78699.591B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopst20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002752.00000001.78699.591B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002752.00000001.78699.591B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002752.00000001.78699.592B2000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportecurityintelligencelocationupdateatscheduledtimeonly1f-90-a<358pindows" - Source: "00000000-00002752.00000001.78699.59319000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0[dyf,-os*or-obw" - Source: "00000000-00002752.00000001.78699.5932E000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00003188.00000001.77878.8B193000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.4@eckp1.3.36.3.3.2.8.1.1.12ecdp1.3.36.3.3.2.8.1.1.9ecdp@1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.3@eckp1.3.36.3.3.2.8.1.1.11ecdp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.9@eckp@1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.7@eckpity.ponatorlion=4.0.0neut19341.3.36.3.3.2.8.1.1.14ecdp34e01.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.6ecdp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11@eckp1.3.36.3.3.2.8.1.1.10@eckp@1.3.36.3.3.2.8.1.1.12@eckp1.2.840.10045.3.1.1@eckp1.3.36.3.3.2.8.1.1.13@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.8@eckp19341.3.36.3.3.2.8.1.1.14@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.2@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.2.840.10045.3.1.2ecdplist2decd1.3.132.0.33@eckpl%iylist1.3.132.0.33ecdp2.23.43.1.4.9ecdp2.23.43.1.4.9@eckpahsm4+m" - Source: "00000000-00003188.00000001.77878.AA460000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003188.00000001.77878.AA501000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00004544.00000001.79581.00CF7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004544.00000001.79581.00CF7000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.mic" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004544.00000001.79581.1B131000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004544.00000001.79581.1B1C1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopss[/" - Source: "00000000-00004544.00000001.79581.1B220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004544.00000001.79581.1B220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004544.00000001.79581.1B33B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004544.00000001.79581.1B33B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.micro" - Source: "00000000-00004544.00000001.79581.1B33B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004544.00000001.79581.1B33B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0jp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>0000p1.3.6.1.4.1.601.10.3.16.84ngton1ond1corpoft" - Source: "00000000-00004544.00000001.79581.1B39E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004544.00000001.79581.1B39E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004544.00000001.79581.1B39E000.00000004.mdmp") Found URL "http://wwboft.com/pki/certs/microoceraut_2010-06-2]fg:s[pcsmwashington1redmond1" - Source: "00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>1.3.6.1.4.1.601.10.3.12.16.840.1.101.3.4.2.1washington1redmond1microsoft" - Source: "00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004544.00000001.79581.1B3BB000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk.$c" - Source: "00000000-00005552.00000001.76346.0E89A000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.36.3.3.2.8.1.1.1ecdp1.3.36.3.3.2.8.1.1.2ecdp1.3.36.3.3.2.8.1.1.2@eckp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.3@eckp1.3.36.3.3.2.8.1.1.4ecdp1.3.36.3.3.2.8.1.1.4@eckp0" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005552.00000001.76346.28C20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/proqs[\washington1redmond1microsoft" - Source: "00000000-00005552.00000001.76346.28CF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005552.00000001.76346.28CF9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0seruser:wdtpwdtpmeow" - Source: "00000000-00005552.00000001.76346.28CF9000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005552.00000001.76346.28D20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005552.00000001.76346.28D20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005552.00000001.76346.28D20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005552.00000001.76346.28D20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005552.00000001.76346.28E77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005552.00000001.76346.28EC2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005552.00000001.76346.28EC2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005552.00000001.76346.28EC2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0$%'%namepropnamepropnamepropnamepropnamepropnamepropnameproptnamepropnamepropnamepropnamepropnamepropab950015400007uroot\cimv2__parametersabstractlocaldatetimedatetimedatetimeab950015400007uroot\cimv2__parametersabstractlocaldatetimedatetimedatetime1q\qnameprop" - Source: "00000000-00005552.00000001.76346.28EC2000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00008740.00000000.77196.8B193000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00009060.00000000.76790.8B193000.00000002.mdmp")79:T11f5,Found registry query API: "Oi:RegEnumKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "RegEnumKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "O:RegEnumKeyExW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegEnumKeyExW:RegQueryInfoKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegEnumKeyExW: Unable to allocate %d bytes" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "Oi:PyRegEnumValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "PyRegEnumValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "|k:RegOpenCurrentUser" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "OO|ii:RegOpenKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "RegOpenKeyTransacted" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "OOkO|k:RegOpenKeyTransacted" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "O:RegQueryInfoKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "O:RegQueryInfoKeyW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "OO:RegQueryValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegQueryValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "OO:RegQueryValueEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry query API: "OO|O:RegSaveKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry query API: "RegSaveKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp"7a:T10e1,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "i:GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "i:GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API ":GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O:VkKeyScan" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OO:VkKeyScanEx" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OO:VkKeyScanEx" (Indicator: "VkKeyScanEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "VkKeyScan" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "VkKeyScanEx" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "VkKeyScanEx" (Indicator: "VkKeyScanEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScanEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "VkKeyScanA" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScanEx"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")7b:T40c,Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" (UID: 00000000-00005552) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (UID: 00000000-00002752) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (UID: 00000000-00004544) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState"" (UID: 00000000-00002260) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids"" (UID: 00000000-00003096)7c:Te7d,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI49162\*.* (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter certifi (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter charset_normalizer (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter Crypto (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter Cryptodome (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter libcrypto-3.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter libffi-8.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter libssl-3.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter lz4 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter lz4-4.4.5.dist-info (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter psutil (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter pyexpat.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter python3.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter python314.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter Pythonwin (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter pywin32_system32 (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter setuptools (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter sqlite3.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter stub.cp314-win_amd64.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00001092) "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" called "FindNextFileW" with parameter VCRUNTIME140_1.dll (UID: 00000000-00001092)7d:Td0d,file/memory contains long string with (Indicator: "fileencrypt"; File: "win32file.pyd") file/memory contains long string with (Indicator: "aes"; File: "_raw_aes.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_eksblowfish.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_blowfish.pyd") file/memory contains long string with (Indicator: "aes"; File: "_raw_aesni.pyd") file/memory contains long string with (Indicator: "chacha"; File: "_chacha20.pyd") file/memory contains long string with (Indicator: "aes"; File: "_cpuid_c.pyd") Found string "stub.Discord.decrypt" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Cookie.decrypt_chrome_key" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Cookie.decrypt_cookie_v20" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Cookie.decrypt_cookie_v10" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Cookie.decrypt_with_cng" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "decrypted_aes_key" (Indicator: "aes"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Cookie.decrypt_cookie_v20_chrome" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Cookie.decrypt_cookie_v10_chrome" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Password.decrypt_chrome_key" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Password.decrypt_with_cng" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Password.decrypt_password_v20" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Password.decrypt_password_v10" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Password.decrypt_password" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Decryptor.LoadNSS" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Decryptor.UnLoadNSS" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Decryptor.SetProfile" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.Decryptor.DecryptPassword" (Indicator: ".decrypt"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "SRTP_AES128_CM_SHA1_80" (Indicator: "aes"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp") Found string "SRTP_AES128_CM_SHA1_80" (Indicator: "aes128"; Source: "00000000-00001092.00000000.75049.60625000.00000002.mdmp")7e:T471,Found reference to API "GetDC" (Indicator: "GetDC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe")7f:T567,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")80:T862,Found string "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption" (Indicator: "Select-Object"; File: "AMSI") Found string "Get-CimInstance -ClassName Win32_LogicalDisk -Filter DeviceID='C:' | Select-Object -ExpandProperty Size" (Indicator: "Select-Object"; File: "AMSI") Found string "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState" (Indicator: "Select-Object"; File: "AMSI") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption""" (Indicator: "Select-Object"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (Indicator: "Select-Object"; File: "powershell.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size""" (Indicator: "Select-Object"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (Indicator: "Select-Object"; File: "powershell.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState""" (Indicator: "Select-Object"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState"" (Indicator: "Select-Object"; File: "powershell.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids""" (Indicator: "Select-Object"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids"" (Indicator: "Select-Object"; File: "powershell.exe")81:T27e5,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API ":GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp") Found reference to API ":GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp") Found reference to API "|O:GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp") Found reference to API "EnumProcessModules failed:" (Indicator: "EnumProcessModules"; Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp")82:T585,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API ":GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API ":GetLogicalDriveStrings" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetLogicalDriveStrings" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")83:T8ce,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "|O:GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp")84:T609,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "stub.WinApi.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp")85:T1519,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API ":GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO|i:GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API ":GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "OO:GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetFileVersionInfo:GetFileVersionInfoSize" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetFileVersionInfo:GetFileVersionInfoSize" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetFileVersionInfo:VerQueryValue" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp")86:T6a0,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "where T1, T2 etc. are TypeVars, which would be invalid, because" (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp") Found string "where '*lang' may be omitted but the other parts may not be." (Indicator: "where "; Source: "00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp")87:T67a,Found string "(Get-CimInstance Win32_OperatingSystem).Caption" (Indicator: "Get-CimInstance"; File: "AMSI") Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimInstance"; File: "AMSI") Found string "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption" (Indicator: "Get-CimInstance"; File: "AMSI") Found string "Get-CimInstance -ClassName Win32_LogicalDisk -Filter DeviceID='C:' | Select-Object -ExpandProperty Size" (Indicator: "Get-CimInstance"; File: "AMSI") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption""" (Indicator: "Get-CimInstance"; File: "cmd.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption""" (Indicator: "Get-CimInstance"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (Indicator: "Get-CimInstance"; File: "powershell.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size""" (Indicator: "Get-CimInstance"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (Indicator: "Get-CimInstance"; File: "powershell.exe")88:T552,Found reference to API ":GetComputerName" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetComputerName" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetComputerNameEx" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "i:GetComputerNameEx" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp")89:T54f,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp")8a:T405,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")8b:T1680,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OO:LookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:LookupAccountSid" (Indicator: "LookupAccountSid"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LookupAccountSid" (Indicator: "LookupAccountSid"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "Ol:GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O|l:GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LsaEnumerateLogonSessions" (Indicator: "LsaEnumerateLogonSessions"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API ":LsaEnumerateLogonSessions" (Indicator: "LsaEnumerateLogonSessions"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "O:LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OO:OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp") Found reference to API ":GetUserName" (Indicator: "GetUserName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetUserName" (Indicator: "GetUserName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CDEF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CDEF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CDEF0000.00000004.mdmp") Found reference to API "GetUserNameEx" (Indicator: "GetUserName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "i:GetUserNameEx" (Indicator: "GetUserName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")8c:T163a,Found string "decrypt_password_v20" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.decrypt_password_v20" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "decrypt_password_v10" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.decrypt_password_v10" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "decrypt_password" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.decrypt_password" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "encrypted_password" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "extract_brave_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_brave_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "extract_chrome_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_chrome_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "extract_edge_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_edge_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "extract_firefox_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_firefox_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "extract_opera_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_opera_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "extract_operagx_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.extract_operagx_passwords" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "password_browser" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.Password.password_browser" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "convert_passwords_json_to_txt" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "stub.ChromelevatorProcessor.convert_passwords_json_to_txt" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "stub.ChromelevatorProcessor.convert_passwords_json_to_txt.chrome_time_to_unix_epoch" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp") Found string "passwords_data" (Indicator: "password"; Source: "00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")8d:T98e,Found string "%WINDIR%\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Ca" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001092-00000C47-25978112612") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003460-00000C47-2624328172") Found string "(Get-CimInstance Win32_OperatingSystem).Caption" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandP" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001596-00000C47-2556681608"), Found string "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption" (Indicator: " Win32_OperatingSystem"; File: "AMSI"), Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Se" (Indicator: " Win32_LogicalDisk"; Source: "00000000-00008096-00000C47-2355678738") Found string "Get-CimInstance -ClassName Win32_LogicalDisk -Filter DeviceID='C:' | Select-Object -ExpandProperty Size" (Indicator: " Win32_LogicalDisk"; File: "AMSI") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption""" (Indicator: " Win32_OperatingSystem"; File: "cmd.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption""" (Indicator: " Win32_OperatingSystem"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (Indicator: " Win32_OperatingSystem"; File: "powershell.exe") Found string "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size""" (Indicator: " Win32_LogicalDisk"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (Indicator: " Win32_LogicalDisk"; File: "powershell.exe")8e:T958,Found registry deletion API: "OO:RegDeleteKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "RegDeleteKey" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry deletion API: "OO|kO:RegDeleteKeyEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyTransacted" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry deletion API: "OO:RegDeleteTree" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "OO:RegDeleteValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00001092.00000000.75049.603F3000.00000002.mdmp"8f:T675,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "win32api.pyd") file/memory contains long string with (Indicator: "OpenProcess"; File: "_psutil_windows.pyd") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001092-00000C2C-174388227") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00005552-00000C2C-185930014") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00005552-00000C2C-185930636") Found string "OO:OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found string "kik:OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")90:T1060,Found string "\Device\HarddiskVolume3\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Indicator: "\Device\"; Source: "00000000-00004916-00000BC0-168391756") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00001092-00000BC0-179429395") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003460-00000BC0-179569657") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003460-00000BC0-180703315") Found string "\Device\HarddiskVolume3\Windows\System32\wbem\WMIC.exe" (Indicator: "\Device\"; Source: "00000000-00006872-00000BC0-195589125") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found string "\Device\HarddiskVolume3\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Indicator: "\Device\"; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000000.75049.CC6A0000.00000004.mdmp, 00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CC6A0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp, 00000000-00001092.00000001.76969.CE43E000.00000004.mdmp, 00000000-00001092.00000001.76969.D00A5000.00000004.mdmp, 00000000-00001092.00000001.76969.D088D000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CC6A0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp, 00000000-00001092.00000002.78890.CE43E000.00000004.mdmp, 00000000-00001092.00000002.78890.D088D000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001092.00000000.75049.CAD10000.00000004.mdmp, 00000000-00001092.00000000.75049.CC6A0000.00000004.mdmp, 00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CAD10000.00000004.mdmp, 00000000-00001092.00000001.76969.CC6A0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE1E5000.00000004.mdmp, 00000000-00001092.00000001.76969.CE43E000.00000004.mdmp, 00000000-00001092.00000001.76969.D00A5000.00000004.mdmp, 00000000-00001092.00000001.76969.D088D000.00000004.mdmp, 00000000-00001092.00000002.78890.CAD10000.00000004.mdmp, 00000000-00001092.00000002.78890.CC6A0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE1E5000.00000004.mdmp, 00000000-00001092.00000002.78890.CE43E000.00000004.mdmp, 00000000-00001092.00000002.78890.D088D000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp")91:T53c,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "O:DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")92:T1105,Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "OlO:AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges: unable to allocate return buffer" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "OO:LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.CE8F0000.00000004.mdmp")93:T416,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "Oi:SetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "SetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")94:T5bd,Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "OOO:LsaAddAccountRights" (Indicator: "LsaAddAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaAddAccountRights: Unable to allocate %d bytes" (Indicator: "LsaAddAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaAddAccountRights" (Indicator: "LsaAddAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OOiO:LsaAddAccountRights" (Indicator: "LsaAddAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaRemoveAccountRights: Unable to allocate %d bytes" (Indicator: "LsaRemoveAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp") Found reference to API "LsaRemoveAccountRights" (Indicator: "LsaRemoveAccountRights"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")95:T10ee,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "?_MakeAbsoluteSD@@YAHPEAXPEAPEAX@Z" (Indicator: "MakeAbsoluteSD"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "DeleteAce" (Indicator: "DeleteAce"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "AddAuditAccessAce" (Indicator: "AddAuditAccessAce"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe")96:T100c,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.6056F000.00000002.mdmp, 00000000-00001092.00000000.75049.60652000.00000002.mdmp, 00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.60C1A000.00000002.mdmp, 00000000-00001092.00000000.75049.613A7000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.83AA7000.00000002.mdmp, 00000000-00001092.00000000.75049.83ACE000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1C3000.00000002.mdmp, 00000000-00001092.00000000.75049.8A1F4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FBB2000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBC3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBD5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FBF3000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC12000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC31000.00000002.mdmp, 00000000-00001092.00000001.76969.5FC42000.00000002.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.5FF73000.00000002.mdmp, 00000000-00001092.00000001.76969.60055000.00000002.mdmp, 00000000-00001092.00000001.76969.60072000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.600A3000.00000002.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.600E3000.00000002.mdmp, 00000000-00001092.00000001.76969.600F3000.00000002.mdmp, 00000000-00001092.00000001.76969.60113000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602BF000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.6067E000.00000002.mdmp, 00000000-00001092.00000001.76969.61396000.00000002.mdmp, 00000000-00001092.00000001.76969.6B522000.00000002.mdmp, 00000000-00001092.00000001.76969.74095000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.5FB93000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBA3000.00000002.mdmp, 00000000-00001092.00000002.78890.5FBE4000.00000002.mdmp, 00000000-00001092.00000002.78890.5FC06000.00000002.mdmp, 00000000-00001092.00000002.78890.5FF86000.00000002.mdmp, 00000000-00001092.00000002.78890.600C9000.00000002.mdmp, 00000000-00001092.00000002.78890.60103000.00000002.mdmp, 00000000-00001092.00000002.78890.60332000.00000002.mdmp, 00000000-00001092.00000002.78890.603C1000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.8A1D6000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "Oi:TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")97:T2629,Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeMachineAccountPrivilege" (Indicator: "SeMachineAccountPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeSystemtimePrivilege" (Indicator: "SeSystemtimePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeRemoteShutdownPrivilege" (Indicator: "SeRemoteShutdownPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeSyncAgentPrivilege" (Indicator: "SeSyncAgentPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeEnableDelegationPrivilege" (Indicator: "SeEnableDelegationPrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeManageVolumePrivilege" (Indicator: "SeManageVolumePrivilege"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CED10000.00000004.mdmp, 00000000-00001092.00000002.78890.CEE20000.00000004.mdmp") Found reference to API "SeInteractiveLogonRight" (Indicator: "SeInteractiveLogonRight"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "SeNetworkLogonRight" (Indicator: "SeNetworkLogonRight"; Source: "00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp")98:Ta16,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "12F1B0E2CC7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "DC40021FCD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "��"") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A416AF26CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "4F1F2B2DCD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "33FBE163CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "760983A3CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "1E30AE0ECE7EDC010000000000000000000000000200000000")99:T1449,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pythoncom314.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: pywintypes314.dll] Observed import api "AddAuditAccessAce" which can "add a system-audit access control entry (ACE) to a system access control list (ACL)" [Source: pywintypes314.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: pywintypes314.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: pywintypes314.dll] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: pywintypes314.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: pywintypes314.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: pywintypes314.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: pywintypes314.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: pywintypes314.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: pywintypes314.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: pywintypes314.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: pywintypes314.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: pywintypes314.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: pywintypes314.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: pywintypes314.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: pywintypes314.dll] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: pywintypes314.dll] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: pywintypes314.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: pywintypes314.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pywintypes314.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: pywintypes314.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: pywintypes314.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: pywintypes314.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: pywintypes314.dll] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: pywintypes314.dll]9a:T9c6,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\55790767E48D39D71BF0814BA9AB4BD294DE825CCAB8B01CFA854399E2E935C8.EXE"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")9b:Tac9,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "12F1B0E2CC7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "DC40021FCD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "��"") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A416AF26CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "4F1F2B2DCD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "33FBE163CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "760983A3CD7EDC010000000000000000000000000200000000") "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "1E30AE0ECE7EDC010000000000000000000000000200000000") "WMIC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WMIC.EXE"; Key: "VBSCRIPTSETSCRIPTSTATESTARTED"; Value: "DCD417360000000000")9c:T7c6,Found reference to API "OOlll:InitiateSystemShutdown" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "InitiateSystemShutdown" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "|ll:ExitWindows" (Indicator: "ExitWindows"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "ExitWindows" (Indicator: "ExitWindows"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "l|l:ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp") Found reference to API "OO:SetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp") Found reference to API "InitiateSystemShutdownW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00001092.00000000.75049.603F3000.00000002.mdmp")9d:Ta77,Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI")9e:T454,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FEA5000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp")9f:T10b1,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\python314.dll]- [targetUID: 00000000-00004916] "mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00004916] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libcrypto-3.dll]- [targetUID: 00000000-00004916] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\sqlite3.dll]- [targetUID: 00000000-00004916] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libssl-3.dll]- [targetUID: 00000000-00004916] "pythoncom314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pythoncom314.dll]- [targetUID: 00000000-00004916] "pywintypes314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pywintypes314.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140.dll]- [targetUID: 00000000-00004916] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI49162\python3.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004916] "stub.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\stub.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00004916] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\unicodedata.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_zstd.pyd]- [targetUID: 00000000-00004916] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_decimal.pyd]- [targetUID: 00000000-00004916] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\pyexpat.pyd]- [targetUID: 00000000-00004916] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ssl.pyd]- [targetUID: 00000000-00004916] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_lzma.pyd]- [targetUID: 00000000-00004916] "win32file.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32file.pyd]- [targetUID: 00000000-00004916] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ctypes.pyd]- [targetUID: 00000000-00004916] "win32security.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32security.pyd]- [targetUID: 00000000-00004916] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32api.pyd]- [targetUID: 00000000-00004916]a0:T5863,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\python314.dll]- [targetUID: 00000000-00004916] "mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00004916] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libcrypto-3.dll]- [targetUID: 00000000-00004916] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\sqlite3.dll]- [targetUID: 00000000-00004916] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\libssl-3.dll]- [targetUID: 00000000-00004916] "pythoncom314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pythoncom314.dll]- [targetUID: 00000000-00004916] "pywintypes314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\pywin32_system32\pywintypes314.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140.dll]- [targetUID: 00000000-00004916] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI49162\python3.dll]- [targetUID: 00000000-00004916] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004916] "stub.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\stub.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00004916] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\unicodedata.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00004916] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_zstd.pyd]- [targetUID: 00000000-00004916] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_decimal.pyd]- [targetUID: 00000000-00004916] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\pyexpat.pyd]- [targetUID: 00000000-00004916] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ssl.pyd]- [targetUID: 00000000-00004916] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_lzma.pyd]- [targetUID: 00000000-00004916] "win32file.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32file.pyd]- [targetUID: 00000000-00004916] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_ctypes.pyd]- [targetUID: 00000000-00004916] "win32security.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32security.pyd]- [targetUID: 00000000-00004916] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32api.pyd]- [targetUID: 00000000-00004916] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_sqlite3.pyd]- [targetUID: 00000000-00004916] "win32crypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32crypt.pyd]- [targetUID: 00000000-00004916] "md__mypyc.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\charset_normalizer\md__mypyc.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_bz2.pyd]- [targetUID: 00000000-00004916] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_socket.pyd]- [targetUID: 00000000-00004916] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49162\_asyncio.pyd]- [targetUID: 00000000-00004916] "_block.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\lz4\block\_block.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ed448.pyd]- [targetUID: 00000000-00004916] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00004916] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_hashlib.pyd]- [targetUID: 00000000-00004916] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00004916] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_curve448.pyd]- [targetUID: 00000000-00004916] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00004916] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_overlapped.pyd]- [targetUID: 00000000-00004916] "win32process.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32process.pyd]- [targetUID: 00000000-00004916] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_des.pyd]- [targetUID: 00000000-00004916] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00004916] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00004916] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00004916] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_wmi.pyd]- [targetUID: 00000000-00004916] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_multiprocessing.pyd]- [targetUID: 00000000-00004916] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_queue.pyd]- [targetUID: 00000000-00004916] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00004916] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00004916] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\select.pyd]- [targetUID: 00000000-00004916] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00004916] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Math\_modexp.pyd]- [targetUID: 00000000-00004916] "win32event.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32event.pyd]- [targetUID: 00000000-00004916] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\_uuid.pyd]- [targetUID: 00000000-00004916] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA512.pyd]- [targetUID: 00000000-00004916] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA384.pyd]- [targetUID: 00000000-00004916] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00004916] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00004916] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00004916] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00004916] "win32trace.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\win32trace.pyd]- [targetUID: 00000000-00004916] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00004916] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00004916] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA256.pyd]- [targetUID: 00000000-00004916] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA224.pyd]- [targetUID: 00000000-00004916] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00004916] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00004916] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00004916] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00004916] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00004916] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00004916] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00004916] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00004916] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00004916] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00004916] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00004916] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_SHA1.pyd]- [targetUID: 00000000-00004916] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00004916] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD5.pyd]- [targetUID: 00000000-00004916] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00004916] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_keccak.pyd]- [targetUID: 00000000-00004916] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00004916] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00004916] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00004916] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00004916] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00004916] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00004916] "_win32sysloader.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI49162\win32\_win32sysloader.pyd]- [targetUID: 00000000-00004916] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00004916] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00004916] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00004916] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD2.pyd]- [targetUID: 00000000-00004916] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_MD4.pyd]- [targetUID: 00000000-00004916] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00004916] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00004916] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00004916] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00004916] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00004916] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00004916] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00004916] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00004916] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_poly1305.pyd]- [targetUID: 00000000-00004916] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00004916] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00004916] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00004916] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_chacha20.pyd]- [targetUID: 00000000-00004916] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00004916] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00004916] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00004916] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00004916] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Protocol\_scrypt.pyd]- [targetUID: 00000000-00004916] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00004916] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00004916] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00004916] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00004916] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00004916] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00004916] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00004916] "_version.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\lz4\_version.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_ARC4.pyd]- [targetUID: 00000000-00004916] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00004916] "md.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\charset_normalizer\md.cp314-win_amd64.pyd]- [targetUID: 00000000-00004916] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Util\_strxor.pyd]- [targetUID: 00000000-00004916] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00004916] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Util\_cpuid_c.pyd]- [targetUID: 00000000-00004916] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00004916] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00004916] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49162\Cryptodome\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00004916]a1:T9c4c,"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Crypto\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Cryptodome\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI49162\Pythonwin\mfc140u.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...a2:T4bd,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ytpuhgl3.w30.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_rrbnqwnj.mz1.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1uaokju4.p5o.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_my4vouoo.lqt.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_baieujxo.mol.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_5k5otcbr.rry.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_f2yh3ks3.fn4.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_4ewgqpfc.1ne.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ap0luiyh.252.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_y02vu5rc.uax.psm1" with delete accessa3:T472,OpenProcessToken GetModuleFileNameW GetProcAddress CreateProcessW CreateFileW GetModuleHandleExW GetCommandLineA GetModuleHandleW CreateDirectoryW VirtualProtect DeleteFileW LoadLibraryExW GetTempPathW TerminateProcess FindNextFileW GetFileAttributesExW IsDebuggerPresent Sleep GetDriveTypeW UnhandledExceptionFilter GetCommandLineW GetStartupInfoW GetFileSizeEx FindFirstFileW FindFirstFileExW WriteFile LoadLibraryW GetSystemDirectoryA LoadLibraryA GetSystemInfo VirtualAlloc recvfrom socket sendto closesocket bind send connect recv WSAStartup listen accept GetTickCount GetFileAttributesW DeleteFileA GetFileAttributesA MapViewOfFile OutputDebugStringW GetFileSize CreateFileA CreateFileMappingW OutputDebugStringA GetTempPathA CreateFileMoniker SetSecurityDescriptorDacl RegCloseKey GetModuleHandleA FindResourceExW CreateThread SleepConditionVariableSRW FindWindowW GetLastActivePopup GetCursorPos FindWindowExW SetWindowsHookExW SleepConditionVariableCS LoadLibraryExA CreateDirectoryExW DeviceIoControl GetFileAttributesExA GetLogicalDrives CopyFileW WSASenda4:T4b8,Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" (UID: 00000000-00005552) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"" (UID: 00000000-00003188) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (UID: 00000000-00002752) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (UID: 00000000-00004544) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState"" (UID: 00000000-00002260) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids"" (UID: 00000000-00003096)a5:Tc1c,Spawned process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00004916) Spawned process "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe" (UID: 00000000-00001092) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption""" (UID: 00000000-00003460) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"" (UID: 00000000-00005552) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00006872) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00009060) Spawned process "cmd.exe" with commandline "/c "wmic os get caption"" (UID: 00000000-00005716) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00008740) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode""" (UID: 00000000-00004136) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"" (UID: 00000000-00003188) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption""" (UID: 00000000-00001596) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption"" (UID: 00000000-00002752) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size""" (UID: 00000000-00008096) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object -ExpandProperty Size"" (UID: 00000000-00004544) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState""" (UID: 00000000-00008512) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState"" (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids""" (UID: 00000000-00000448) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids"" (UID: 00000000-00003096)a6:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3AAB/////////////////9wAAf/////////////////cAAH////ZmZmZmZv/////3AAB////2ZmZmZmb/////9wAAf///9mZmZmZm93d///cAAH93f/ZmZmZmZv/////3AAB////2ZmZmZmb3d3d39wAAf///9mZmZmZm//////cAAH93f/ZmZmZmZvd3d3f3AAB////2ZmZmZmb/////9wAAf///9mZmZmZm93d3d/cAAH93f/ZmZmZmZv/////3AAB////2ZmZmZmb3d3d39wAAf///9mZmZmZm//////cAAH93f/ZmZmZmZvd3d3f3AAB////2ZmZmZmb/////9wAAf/////////////////cAAH/////////////////3AAB3d3d3d3d3d3d3d4eHhwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////////////////////AAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAP//////////////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791330651101,"unified_at":"2026-10-06T23:50:51.101Z","metadata":{"hashes":{"sha256":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","sha1":"e5130fc13613fce0f9cf16e92f696068e8993802","md5":"4ac225bf392d0f8343478f6dc568143b","sha512":"136852bf67b1f2c4e782d3ef9b58775792b65277a23117e5dfa87b4d4a7879334166bdaaa5d1f5301ada6f3a1d4f1b1e894cf1f67eaf4653f6f5817d61287369","ssdeep":"393216:kqyCr2bcsbAemqSEVJEoa163OPsZg2Ke4fDVymK435HsF5ladgZb7EPONNrtnC6y:kq5rpl8c163rLX4y6EUdwbCE9Ry","ssdeep_chunks":["393216:kqyCr2b","393216:qyCr2bc","393216:yCr2bcs","393216:Cr2bcsb","393216:r2bcsbA","393216:2bcsbAe","393216:bcsbAem","393216:csbAemq","393216:sbAemqS","393216:bAemqSE","393216:AemqSEV","393216:emqSEVJ","393216:mqSEVJE","393216:qSEVJEo","393216:SEVJEoa","393216:EVJEoa1","393216:VJEoa16","393216:JEoa163","393216:Eoa163O","393216:oa163OP","393216:a163OPs","393216:163OPsZ","393216:63OPsZg","393216:3OPsZg2","393216:OPsZg2K","393216:PsZg2Ke","393216:sZg2Ke4","393216:Zg2Ke4f","393216:g2Ke4fD","393216:2Ke4fDV","393216:Ke4fDVy","393216:e4fDVym","393216:4fDVymK","393216:fDVymK4","393216:DVymK43","393216:VymK435","393216:ymK435H","393216:mK435Hs","393216:K435HsF","393216:435HsF5","393216:35HsF5l","393216:5HsF5la","393216:HsF5lad","393216:sF5ladg","393216:F5ladgZ","393216:5ladgZb","393216:ladgZb7","393216:adgZb7E","393216:dgZb7EP","393216:gZb7EPO","393216:Zb7EPON","393216:b7EPONN","393216:7EPONNr","393216:EPONNrt","393216:PONNrtn","393216:ONNrtnC","393216:NNrtnC6","393216:NrtnC6y","786432:kqyCr2b","786432:qyCr2bc","786432:yCr2bcs","786432:Cr2bcsb","786432:r2bcsbA","786432:2bcsbAe","786432:bcsbAem","786432:csbAemq","786432:sbAemqS","786432:bAemqSE","786432:AemqSEV","786432:emqSEVJ","786432:mqSEVJE","786432:qSEVJEo","786432:SEVJEoa","786432:EVJEoa1","786432:VJEoa16","786432:JEoa163","786432:Eoa163O","786432:oa163OP","786432:a163OPs","786432:163OPsZ","786432:63OPsZg","786432:3OPsZg2","786432:OPsZg2K","786432:PsZg2Ke","786432:sZg2Ke4","786432:Zg2Ke4f","786432:g2Ke4fD","786432:2Ke4fDV","786432:Ke4fDVy","786432:e4fDVym","786432:4fDVymK","786432:fDVymK4","786432:DVymK43","786432:VymK435","786432:ymK435H","786432:mK435Hs","786432:K435HsF","786432:435HsF5","786432:35HsF5l","786432:5HsF5la","786432:HsF5lad","786432:sF5ladg","786432:F5ladgZ","786432:5ladgZb","786432:ladgZb7","786432:adgZb7E","786432:dgZb7EP","786432:gZb7EPO","786432:Zb7EPON","786432:b7EPONN","786432:7EPONNr","786432:EPONNrt","786432:PONNrtn","786432:ONNrtnC","786432:NNrtnC6","786432:NrtnC6y","393216:kq5rpl8","393216:q5rpl8c","393216:5rpl8c1","393216:rpl8c16","393216:pl8c163","393216:l8c163r","393216:8c163rL","393216:c163rLX","393216:163rLX4","393216:63rLX4y","393216:3rLX4y6","393216:rLX4y6E","393216:LX4y6EU","393216:X4y6EUd","393216:4y6EUdw","393216:y6EUdwb","393216:6EUdwbC","393216:EUdwbCE","393216:UdwbCE9","393216:dwbCE9R","393216:wbCE9Ry"],"imphash":"dcaf48c1f10b0efa0a4472200f3850ed"},"file_info":{"file_name":"PoligonVRSetup.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":22241368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767450363000,"last_seen":1767653240000,"last_multi_scan":1767653240000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":103},"sandbox_signatures":{"informative_count":269,"suspicious_count":17,"malicious_count":4,"total":290},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Able to access mailslot-related API (String)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains reference to WMI activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Imports mailslot-related APIs"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"},{"type":"informative","value":"Retrieves instances of WMI objects using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"User-Agent string indicates scripted web access"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$27","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1765914574849', 'hResInfo': '1765914583264'}\" (UID: 00000000-00005552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1765914574849', 'hResInfo': '1765914583296'}\" (UID: 00000000-00005552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1765914574849', 'hResInfo': '1765914583312'}\" (UID: 00000000-00005552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1765914574849', 'hResInfo': '1765914583280'}\" (UID: 00000000-00005552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"O:ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001092.00000001.76969.CC5B0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - (\\.\\w+|\\; Source: \"00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp\")\n Found string - \\\\.\\NUL; Source: \"00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp\")\n Found string - \\.\\S+); Source: \"00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"win32crypt.pyd\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$30","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$31","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$32","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"lOl:EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"Ol:DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"dane tlsa bad public key\" (Indicator: \"public key\"; Source: \"00000000-00001092.00000000.75049.60625000.00000002.mdmp\")\n Found string \"no private key assigned\" (Indicator: \"private key\"; Source: \"00000000-00001092.00000000.75049.60625000.00000002.mdmp\")\n Found string \"private key mismatch\" (Indicator: \"private key\"; Source: \"00000000-00001092.00000000.75049.60625000.00000002.mdmp\")\n Found string \"unable to find public key parameters\" (Indicator: \"public key\"; Source: \"00000000-00001092.00000000.75049.60625000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Encoding\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive\"\n Contains base64 string in header \"gzip\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive\"\n Contains base64 string in header \"keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$34","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001092-00000C2C-174947071\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005552-00000C2C-187011347\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001092-00000C2C-174947071\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005552-00000C2C-187011347\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"_psutil_windows.pyd\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001092-00000C2C-175704198\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00001092-00000C2C-175808097\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"win32file.pyd\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00001092-00000C2C-173099790\")\n Found reference to API \"GetComputerObjectName\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"i:GetComputerObjectName\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005552)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004916)\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001092)\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004916)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005552)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003188)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002752)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004544)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004916)\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001092)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003460)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005552)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005552)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005552)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003188)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003188)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002752)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$3f","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$41","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"|i:GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \":GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"O:GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005552-00000C17-190522496\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003188-00000C17-216460317\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002752-00000C17-227549951\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004544-00000C17-240554569\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002260-00000C17-254031401","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI49162\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"win32api.pyd\")\n Found string \":GetCommandLine\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found string \"GetCommandLine\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005552)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003188)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002752)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004544)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$48","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$49","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001092)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"\n \"140.82.112.3:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\"), \"Insert a simple entry into the list of warnings filters (at the front).\" (Source: 00000000-00001092.00000000.75049.CCFF0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCFF0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCFF0000.00000004.mdmp, Indicator: \"insert a simple entry into the list of warnings filters (at the front).\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.60308000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CreateDirectoryExW\" (Indicator: \"CreateDirectory\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pywintypes314.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: win32file.pyd)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$56","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains reference to WMI activity (Powershell command string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-390","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: win32file.pyd)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp\n 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp\n 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00001092.00000000.75049.CCBA0000.00000004.mdmp\n 00000000-00001092.00000001.76969.CCBA0000.00000004.mdmp\n 00000000-00001092.00000002.78890.CCBA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$58","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$59","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$5b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$5c","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"bzip2-devel@sourceware.org\"\n Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134121507368591087.5552.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134121508508871235.3188.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134121508618315145.2752.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134121509534759854.4544.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134121510602638906.2260.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$5e","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\" Response ==> HTTP/1.1 200 OK\nDate: Mon\n 05 Jan 2026 21:27:33 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>36363A36313A36633A37333A36353A3061.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$5f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 5DC20000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 5D880000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8B1E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8B1E0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8B1E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98870000\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98870000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990F0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98870000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 5F1E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 5EE40000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9ACA0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9ACA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9ACA0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9ACA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020425599fb7f0000@ntdll.dll\"\n \"220023000000000040425599fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$60","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$61","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$62","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$63","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3.dll\" : \"491\" [Source: libssl-3.dll]\n Observed large number of imported APIs from \"python314.dll\" : \"212\" [Source: stub.cp314-win_amd64.pyd]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$64","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$65","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x377000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x140400\" greater than 0x100000\n Raw size of \".text\" is \"0x13be00\" greater than 0x100000\n Raw size of \".text\" is \"0x15dc00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x376f14\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x140290\" greater than 0x100000\n Virtual size of \".text\" is \"0x13bd52\" greater than 0x100000\n Virtual size of \".text\" is \"0x15da08\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$66","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$67","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"github.com\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$69","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$6b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$6c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: E4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: E8:49:90:CB:9B:F8:E3:AB:0B:CA:E8:A6:49:CB:30:FE:4D:C4:D7:67; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: CA:77:88:C3:2D:A1:E4:B7:86:3A:4F:B5:7D:00:B5:5D:DA:CB:C7:F9; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_ARC4.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_chacha20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_raw_aes.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_raw_aesni.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$6e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$6f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$70","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_ARC4.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_chacha20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_raw_aes.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI49162\\Crypto\\Cipher\\_raw_aesni.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" queries basic process information of the \"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" (UID: 4916)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$71","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" reads file \"c:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$72","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$73","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$74","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_arc4.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_salsa20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_chacha20.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_pkcs1_decode.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_raw_aes.pyd\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei49162\\crypto\\cipher\\_raw_aesni.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gen_py\\3.14\\dicts.dat\"\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes a file \"%TEMP%\\gen_py\\3.14\\dicts.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001092-00000C2C-173099944\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.613C9000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"METADATA\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"192.0.2.0\" found in string \"addr1 = ip_network('192.0.2.0/28')\"\n Potential IP \"192.0.2.1\" found in string \"addr2 = ip_network('192.0.2.1/32')\"\n Potential IPs \"192.0.2.0\"\n \"192.0.2.2\" found in string \"[IPv4Network('192.0.2.0/32'), IPv4Network('192.0.2.2/31'),\"\n Potential IPs \"192.0.2.4\"\n \"192.0.2.8\" found in string \"IPv4Network('192.0.2.4/30'), IPv4Network('192.0.2.8/29')]\"\n Potential IPs \"192.0.2.0\"\n \"192.0.2.128\" found in string \"eg: IPv4Network('192.0.2.0/25') < IPv4Network('192.0.2.128/25')\"\n Potential IPs \"192.0.2.0\"\n \"192.0.2.0\" found in string \"eg: IPv4Network('192.0.2.0/24') == IPv4Network('192.0.2.0/24')\"\n Potential IPs \"192.0.2.128\"\n \"192.0.2.0\" found in string \"eg: IPv4Network('192.0.2.128/25') > IPv4Network('192.0.2.0/25')\"\n Potential IP \"100.64.0.0\" found in string \"``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``\"\n \"46.1.1.36\"\n \"3.7.66.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$77","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$78","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"urllib.request module uses HTTP/1.1 and includes a \"Connection:close\"\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip\n deflate\n zstd\nAccept: */*\nConnection: keep-alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"User-Agent string indicates scripted web access","description":"Found scripted User-Agent python-requests/2.32.5","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"140.82.112.3\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001092\"\n YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on file \"_raw_aes.pyd\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00001092\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00002260\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"\n YARA signature for file using Zlib compression matched on process \"00000000-00004916\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found string \"MICROSOFT_KERBEROS_NAME_A\" (Indicator: \"kerberos\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found string \"PolicyNotifyDomainKerberosTicketInformation\" (Indicator: \"kerberos\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CreateMailslotW\" (Indicator: \"CreateMailslot\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"win32api.pyd\")\n Found string \"O|i:DragQueryFile\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found string \"DragQueryFile\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\"\n Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"$7b","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$7c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00009060)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00008740)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005552)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003188)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002752)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004544)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"CreateMailslotW\" (Indicator: \"CreateMailslot\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: win32ui.pyd)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"LsaEnumerateLogonSessions\" (Indicator: \"EnumerateLogonSessions\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \":LsaEnumerateLogonSessions\" (Indicator: \"EnumerateLogonSessions\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"O:LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$81","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"ii|ii:keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"iii|ii:mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcName\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"|OOOOi:DsGetDcName\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")\n Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-259","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"OO:LookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")\n Found reference to API \"LookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000002.78890.D0BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"pythoncom314.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$86","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve instances of WMI objects (Powershell command string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-277","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir - A directory to create this temp dir in. (see mkdtemp)\" (Indicator: \"dir \"; Source: \"00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000000.75049.CD0F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CD0F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CD0F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"i:GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \":PyGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001092.00000000.75049.603F3000.00000002.mdmp, 00000000-00001092.00000001.76969.6008C000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")\n Found reference to API \"OO:CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.5FF11000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.83AF4000.00000002.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$8c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname blacklist kontrol\" (Indicator: \"hostname\"; Source: \"00000000-00001092.00000000.75049.6056F000.00000002.mdmp\")\n Found string \"Route attribute access on a class to __getattr__.\" (Indicator: \"route\"; Source: \"00000000-00001092.00000000.75049.CCCA0000.00000004.mdmp, 00000000-00001092.00000001.76969.CCCA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCCA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports mailslot-related APIs","description":"Observed import api \"GetMailslotInfo\" which can \"retrieve information about the specified mailslot\" [Source: win32file.pyd]\n Observed import api \"CreateMailslot\" which can \"create a mailslot with the specified name\" [Source: win32file.pyd]\n Observed import api \"SetMailslotInfo\" which can \"set the time-out value used by the specified mailslot for a read operation\" [Source: win32file.pyd]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-83","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves instances of WMI objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"(Get-CimInstance Win32_OperatingSystem).Caption\"\" (UID: 00000000-00005552)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption\"\" (UID: 00000000-00002752)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_LogicalDisk -Filter \"DeviceID='C:'\" | Select-Object -ExpandProperty Size\"\" (UID: 00000000-00004544)","origin":"Monitored Target","mitre_attack_id":"T1518.001","relevance":3,"id":"target-450","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption\"\" (UID: 00000000-00002752)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_LogicalDisk -Filter \"DeviceID='C:'\" | Select-Object -ExpandProperty Size\"\" (UID: 00000000-00004544)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState\"\" (UID: 00000000-00002260)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids\"\" (UID: 00000000-00003096)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$8e","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$8f","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001092)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005552)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003188)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002752)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004544)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$90","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"O:ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000000.75049.CE7F0000.00000004.mdmp, 00000000-00001092.00000001.76969.CE7F0000.00000004.mdmp, 00000000-00001092.00000002.78890.CE7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$91","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$92","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$93","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$94","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$95","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"Found reference to API \"DefineDosDeviceW\" (Indicator: \"DefineDosDevice\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\n Observed string: \"shutdown while in init\" (Indicator: \"shutdown \") in Source: 00000000-00001092.00000000.75049.60625000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$96","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$97","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001092.00000000.75049.60B60000.00000002.mdmp, 00000000-00001092.00000000.75049.744D4000.00000002.mdmp, 00000000-00001092.00000000.75049.CCDA0000.00000004.mdmp, 00000000-00001092.00000001.76969.600B6000.00000002.mdmp, 00000000-00001092.00000001.76969.6025D000.00000002.mdmp, 00000000-00001092.00000001.76969.602E6000.00000002.mdmp, 00000000-00001092.00000001.76969.8B193000.00000002.mdmp, 00000000-00001092.00000001.76969.CCDA0000.00000004.mdmp, 00000000-00001092.00000002.78890.CCDA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$98","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$99","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$9a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$9b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00001092.00000000.75049.60394000.00000002.mdmp, 00000000-00001092.00000001.76969.D0CE0000.00000004.mdmp, 00000000-00001092.00000002.78890.D0CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$9c","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$9d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$9e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$9f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002260]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CompareStringEx\" (Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: 55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"libcrypto-3.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"libssl-3.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"python3.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5552)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3188)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2752)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4544)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2260)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"_ec_ws.pyd\" has section name .rdata with entropy \"7.696659543136773\"\n \"_ec_ws.pyd\" has section name .rdata with entropy \"7.696659562266471\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" has resource with unusual entropy \"RT_ICON:7.407575593689034\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" writes archive file \"%TEMP%\\_MEI49162\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$a0","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$a1","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header\n TCP traffic to 140.82.112.3 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"_chacha20.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"_chacha20.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00004916\"\n YARA signature matched on AES instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on AES instruction used in file \"_raw_aesni.pyd\"\n YARA signature matched on Chacha20 instruction used in process \"00000000-00001092\"\n YARA signature matched on Chacha20 instruction used in file \"sqlite3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"python314.dll\"\n YARA signature matched on Chacha20 instruction used in file \"_chacha20.pyd\"\n YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00001092\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$a2","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00005552)\n \"WMIC.exe\" opens a process \"C:\\Windows\\System32\\cmd.exe\" (UID: 00000000-00009060)\n \"WMIC.exe\" opens a process \"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" (UID: 00000000-00009060)\n \"WMIC.exe\" opens a process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (UID: 00000000-00009060)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"libcrypto-3.dll\" claimed CRC 5243768 while the actual is CRC 22259555\n \"sqlite3.dll\" claimed CRC 1595376 while the actual is CRC 5243768\n \"libssl-3.dll\" claimed CRC 833463 while the actual is CRC 1595376\n \"VCRUNTIME140.dll\" claimed CRC 123501 while the actual is CRC 194884\n \"python3.dll\" claimed CRC 137703 while the actual is CRC 123501\n \"VCRUNTIME140_1.dll\" claimed CRC 52724 while the actual is CRC 137703\n \"unicodedata.pyd\" claimed CRC 763359 while the actual is CRC 1116971\n \"_zstd.pyd\" claimed CRC 512408 while the actual is CRC 818563\n \"_decimal.pyd\" claimed CRC 308248 while the actual is CRC 512408\n \"pyexpat.pyd\" claimed CRC 283083 while the actual is CRC 308248\n \"_ssl.pyd\" claimed CRC 245850 while the actual is CRC 283083\n \"_lzma.pyd\" claimed CRC 163626 while the actual is CRC 184391\n \"_ctypes.pyd\" claimed CRC 169945 while the actual is CRC 194443","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$a3","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"VCRUNTIME140.dll\" claims program is from Mon Nov 21 08:39:02 2033\n \"VCRUNTIME140_1.dll\" claims program is from Thu Jun 10 23:23:34 1982","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" wrote 000011C0 bytes to a remote process \"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" (Handle: 428)\n \"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" wrote 00000008 bytes to a remote process \"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe\" (Handle: 428)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$a4","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$a5","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Reads system information using WMIC"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":61,"imported_dlls_count":132,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":167,"files_deleted_count":0,"registry_keys_created_count":22,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":22,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"695c3f760689918e600f2164","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","analysis_start_time":"2026-01-05T22:47:18+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"695c2c0e76e12765ca06ad31","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA","ZZZ"],"submit_name":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","analysis_start_time":"2026-01-05T21:24:33+00:00","indicators_count":{"informative":269,"suspicious":68,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"address":"140.82.112.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"dns_resolutions":[{"domain":"github.com","address":"140.82.112.3","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"Reserved","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=hosting","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}],"processes":[{"pid":4916,"ppid":0,"name":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","command_line":"","sha256":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","normalized_path":"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","uid":"00000000-00004916","icon":"$a6"},{"pid":1092,"ppid":4916,"name":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","command_line":"","sha256":"55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8","normalized_path":"C:\\55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8.exe","parent_uid":"00000000-00004916","uid":"00000000-00001092"},{"pid":3460,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"(Get-CimInstance Win32_OperatingSystem).Caption\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00003460"},{"pid":5552,"ppid":3460,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"(Get-CimInstance Win32_OperatingSystem).Caption\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003460","uid":"00000000-00005552"},{"pid":6872,"ppid":1092,"name":"cmd.exe","command_line":"/c \"wmic os get caption\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00006872"},{"pid":9060,"ppid":6872,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00006872","uid":"00000000-00009060"},{"pid":5716,"ppid":1092,"name":"cmd.exe","command_line":"/c \"wmic os get caption\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00005716"},{"pid":8740,"ppid":5716,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00005716","uid":"00000000-00008740"},{"pid":4136,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"$ExecutionContext.SessionState.LanguageMode\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00004136"},{"pid":3188,"ppid":4136,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"$ExecutionContext.SessionState.LanguageMode\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004136","uid":"00000000-00003188"},{"pid":1596,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00001596"},{"pid":2752,"ppid":1596,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty Caption\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001596","uid":"00000000-00002752"},{"pid":8096,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_LogicalDisk -Filter \"DeviceID='C:'\" | Select-Object -ExpandProperty Size\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00008096"},{"pid":4544,"ppid":8096,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-CimInstance -ClassName Win32_LogicalDisk -Filter \"DeviceID='C:'\" | Select-Object -ExpandProperty Size\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008096","uid":"00000000-00004544"},{"pid":8512,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00008512"},{"pid":2260,"ppid":8512,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpComputerStatus | Select-Object -ExpandProperty SmartAppControlState\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008512","uid":"00000000-00002260"},{"pid":448,"ppid":1092,"name":"cmd.exe","command_line":"/c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001092","uid":"00000000-00000448"},{"pid":3096,"ppid":448,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000448","uid":"00000000-00003096"}],"all_imported_dlls":["gdi32full.dll","sechost.dll","psapi.dll","mswsock.dll","sqlite3.dll","kernel.appcore.dll","System.Core.ni.dll","System.Management.ni.dll","ws2_32.dll","clbcatq.dll","fastprox.dll","System.DirectoryServices.ni.dll","Microsoft.Management.Infrastructure.CimCmdlets.ni.dll","sspicli.dll","ntdll.dll","msvcp_win.dll","rpcrt4.dll","vcruntime140.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","crypt32.dll","wbemcomn.dll","ntmarta.dll","pwrshsip.dll","System.Data.dll","MpClient.dll","ole32.dll","version.dll","cryptbase.dll","System.Xml.ni.dll","miutils.dll","mscoree.dll","Microsoft.PowerShell.Security.ni.dll","kernel32.dll","netapi32.dll","comctl32.dll","combase.dll","libffi-8.dll","iertutil.dll","wbemsvc.dll","System.Transactions.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","userenv.dll","wmi2xml.dll","cryptsp.dll","wLh9QtRh.dll","vcruntime140_1_clr0400.dll","ucrtbase_clr0400.dll","System.ni.dll","propsys.dll","wtsapi32.dll","MpOAV.dll","vcruntime140_clr0400.dll","coml2.dll","user32.dll","libssl-3.dll","SHCore.dll","MSOXMLMF.DLL","pywintypes314.dll","mscorlib.ni.dll","System.Transactions.dll","imm32.dll","python3.dll","msasn1.dll","System.Configuration.Install.ni.dll","oleaut32.dll","msctf.dll","samcli.dll","ntdsapi.dll","urlmon.dll","secur32.dll","amsi.dll","wmiutils.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.Management.Infrastructure.ni.dll","System.Data.ni.dll","pdh.dll","wbemprox.dll","clr.dll","wintrust.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","python314.dll","mi.dll","win32u.dll","IPHLPAPI.DLL","sfc.dll","bcryptprimitives.dll","logoncli.dll","ucrtbase.dll","atl.dll","srvcli.dll","profapi.dll","dpapi.dll","security.dll","fltLib.dll","sxs.dll","windows.storage.dll","gpapi.dll","System.Configuration.ni.dll","gdi32.dll","AppxSip.dll","advapi32.dll","msvcrt.dll","shlwapi.dll","vcruntime140_1.dll","pythoncom314.dll","wldp.dll","vbscript.dll","KernelBase.dll","netutils.dll","Microsoft.Management.Infrastructure.Native.ni.dll","libcrypto-3.dll","powrprof.dll","wbemdisp.dll","mscoreei.dll","msisip.dll","clrjit.dll","VxSSL64.dll","uxtheme.dll","VCRUNTIME140_1.dll","shell32.dll","rsaenh.dll","framedynos.dll","VCRUNTIME140.dll","WinTypes.dll","wshext.dll","bcrypt.dll","sfc_os.dll","umpdc.dll","wmidcom.dll","msxml6.dll","msvcr90.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_Salsa20.pyd","sha256":"9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_chacha20.pyd","sha256":"ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_aes.pyd","sha256":"520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_aesni.pyd","sha256":"3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"libcrypto-3.dll","sha256":"e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"python314.dll","sha256":"d654a3e241cf35bf81481e1a721715dc82a7118ad7f61d325fdfbee503396718","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"sqlite3.dll","sha256":"420c203801acd8d0345f8d5786abb94c60c36605feb4b84fbf27fdbf076ab59c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"StartupProfileData-NonInteractive","sha256":"d69e7f259720a07b954d871a4e592e1672ca122fcc50e646ecd65cb0df197c35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_ARC4.pyd","sha256":"f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_pkcs1_decode.pyd","sha256":"320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_arc2.pyd","sha256":"1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_blowfish.pyd","sha256":"6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_cast.pyd","sha256":"7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_cbc.pyd","sha256":"a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_cfb.pyd","sha256":"cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_ctr.pyd","sha256":"aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_des.pyd","sha256":"0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_des3.pyd","sha256":"b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_ecb.pyd","sha256":"98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_eksblowfish.pyd","sha256":"29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_ocb.pyd","sha256":"c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_raw_ofb.pyd","sha256":"1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"_BLAKE2b.pyd","sha256":"1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"mfc140u.dll","sha256":"6eb497ba5ec743039f2187f382dd95dd091d2fe5f53e30758c879e708a720d2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"VCRUNTIME140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"VCRUNTIME140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"cacert.pem","sha256":"a1ad5d643e21c43b5bed74c7e0891dcdb58f6af51c8ace1e4f020d654aa52a16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"libssl-3.dll","sha256":"1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"python3.dll","sha256":"28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"pythoncom314.dll","sha256":"4f56f39e866d4e9c67c1bae3cbbe92a1fe70391799c1cfcb13b0d94e56c14941","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"pywintypes314.dll","sha256":"74f036548f3321d312205085662b2b92c0654354a718a41c44e02fd4e01fedb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_1uaokju4.p5o.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_ap0luiyh.252.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_baieujxo.mol.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_f2yh3ks3.fn4.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_ytpuhgl3.w30.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_x4p5zpax.0rj.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_1iiqe5xf.e4p.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_530ak5wl.2y2.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"__PSScriptPolicyTest_dr5bms2k.ww3.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\PublicKey\\_curve25519.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\PublicKey\\_curve448.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Crypto\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\PublicKey\\_curve25519.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\PublicKey\\_curve448.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Cryptodome\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Pythonwin\\mfc140u.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\Pythonwin\\win32ui.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_cffi_backend.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\_zstd.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\charset_normalizer\\md.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\charset_normalizer\\md__mypyc.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4-4.4.5.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4\\_version.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\lz4\\block\\_block.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\python3.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\python314.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\pywin32_system32\\pythoncom314.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\pywin32_system32\\pywintypes314.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\select.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\LICENSE","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\stub.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\_win32sysloader.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32api.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32crypt.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32event.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32file.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32process.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32security.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\_MEI49162\\win32\\win32trace.pyd","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\gen_py\\3.14\\__init__.py","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\gen_py\\3.14\\dicts.dat","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\cftmon.exe","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\cftmon.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ytpuhgl3.w30.ps1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_rrbnqwnj.mz1.psm1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1uaokju4.p5o.ps1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_my4vouoo.lqt.psm1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_baieujxo.mol.ps1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_5k5otcbr.rry.psm1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_f2yh3ks3.fn4.ps1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4ewgqpfc.1ne.psm1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ap0luiyh.252.ps1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_y02vu5rc.uax.psm1","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:1092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:1092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:3460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:5552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:5552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9060:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:9060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:9060:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:5716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:8740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:8740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:4136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3188:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3188:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:3188:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:3188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:3188:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:1596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:2752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:2752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:2752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:8096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:4544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:4544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:4544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:8512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:2260:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"SM0:2260:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:2260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2260:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2260:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]},{"name":"Local\\SM0:3096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c2c0e76e12765ca06ad31"}]}]}},"report_ids":{"sandbox_job_ids":["695c2c0e76e12765ca06ad31"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 55790767e48d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 55790767e48d…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 55790767e48d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 55790767e48d…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 55790767e48d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 55790767e48d…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$La7","11",{}]]