24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 6129a08b7656… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 6129a08b7656…. Malware family: Lazy.Generic. Threat score 85/100. 7/25 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf"],"about":{"@type":"SoftwareApplication","name":"RedFire.BYPASS.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb5f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp")26:T5d2,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")27:T521,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp")28:Ta87,file/memory contains long string with (Indicator: "SHA384"; File: "_elementtree.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_asyncio.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_overlapped.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_multiprocessing.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to "Qs7ZngyzsHeXZJzA9KMuH5UHsBffMNsAGJZMoYFL3QRtU6M9/Aes1MU3guvklQgZ" (Indicator: "Aes"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp")29:T44e,Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CheckRemoteDebuggerPresent" (Indicator: "CheckRemoteDebuggerPresent"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")2a:T47b,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")2b:T4e1,file/memory contains long string with (Indicator: "sendmessage"; File: "win32api.pyd") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")2c:T20ed,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000007fb2fd7f00007064bc65e401000018e78f7dd5000000060000000000000031e4a5e8fd7f000000000000000000000000000000000000f0e48f7dd5000000000000000000000040e48f7dd50000001014b6e8fd7f000000000000000000009013b6e8fd7f00000800000000000000101dbb65e401000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff40e48f7dd500000048e48f7dd5000000020000000000000060e58f7dd50000000000000000000000ffffffffffffffffc0cebc65e4010000f385a5e8fd7f0000c0cebc65e401000060e58f7dd500000001000000 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009196) "XG-Team.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000070e171d4190200007e6e8c3a43000000fbeb25a4fd7f000010a360a4fd7f00000000000000000000000000000000000070876fd4190200006ee845a4fd7f000008000000000000000000000000000000ffffffffffffffff60c596cec900000042e525a4fd7f0000080000000000000055f425a4fd7f000070e845a4fd7f0000dddd25a4fd7f0000480000000000000000000000fd7f0000000000000000000010c596cec9000000800b75d41902000070ea6dd419020000b0d963d419020000a0ea4dd21902000050e845a4fd7f000020c696cec90000000000000000000000d0c64fd219020000f06660a4fd7f0000b1dc25a4fd7f0000e0d963d4 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938fee5fd7f00008000000000000000000000000000000020c590d4190200001033a8e8fd7f00000000000000000000000095e6fd7f000050c396cec90000001041fbe5fd7f000000764dd21902000010c396cec9000000000000000000000000000000000000000100000000000000b840fbe5fd7f000000000000000000000100000000000000000095e6fd7f00003b4d38e6fd7f00000000000000000000c8c896cec90000000000000000000000d02aa7e6fd7f000010b30de7fd7f0000e8f8fae5fd7f000010b30de7fd7f0000d02aa7e6fd7f00000d000000fd7f00000d00000000000000a0f6fde6fd7f0000f587a2e6fd7f0000d02aa7e6 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000040e615d519020000f06660a4fd7f0000fbeb25a4fd7f00000000000000000000306560d419020000306560d41902000082e027a4fd7f00006ee845a4fd7f000008000000000000000000000000000000ffffffffffffffffa04896cec900000042e525a4fd7f0000080000000000000055f425a4fd7f000070e845a4fd7f0000dddd25a4fd7f0000480000000000000000000000fd7f0000000000000000000018e645a4fd7f0000084996cec9000000b0ba69d419020000305b0ed519020000a0ea4dd21902000050e845a4fd7f0000604996cec90000000000000000000000d0c64fd219020000f06660a4fd7f0000b1dc25a4fd7f0000605b0ed5 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000b9e795cec900000030bd9ce7fd7f000000d0a7e7fd7f0000030000000000000030bd9ce7fd7f0000505291d419020000905291d4190200000300000000000000681ea6e8fd7f00000000000000000000005291d419020000a00000000000000070e795cec900000000d0a7e7fd7f0000131da6e8fd7f0000505291d419020000905291d419020000505291d41902000030bd9ce7fd7f000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d2d7a9e8fd7f000030bd9ce7fd7f00009051bbe8fd7f000048ed95cec9000000d917a4b2fd7f000000000000 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d0c64fd2190200000000000000000000906429a4fd7f000010a360a4fd7f0000209c96cec9000000000000000000000068020000000000000000000000000000a097def419020000010000007f000000d07cfff419020000000000001902000030a596cec9000000e88362d419020000500902f5190200007a406ad41902000063d025a4fd7f0000f06660a4fd7f00000000000000000000e88362d419020000408262d41902000050406ad419020000d07cfff419020000f8a760a4fd7f0000d07cfff419020000b03b6ad419020000b06360d419020000700666d4190200001c2a28a4fd7f0000a0ea4dd21902000010a360a4fd7f00005f000000 (UID: 00000000-00009912) "XG-Team.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000006df128a4fd7f00000200000000000000000000000000000020e896cec90000000001000000000000d8e696cec9000000a006edf619020000004a67d4190200007a8128a4fd7f000021ea96cec9000000a0e796cec9000000000000000000000020ea96cec900000025ea96cec90000000000000000000000b0e996cec9000000e01776d419020000f81776d4190200000000000000000000b0819bf6190200006e1c29a4fd7f00006ee845a4fd7f000008000000000000000000000000000000ffffffffffffffff10e896cec900000042e525a4fd7f0000080000000000000055f425a4fd7f000070e845a4fd7f0000dddd25a4fd7f0000f12c77f3 (UID: 00000000-00009912)2d:T49d,Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")2e:T49b,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Py_GetVersion" (Indicator: "GetVersion"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Py_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp")2f:Tc3f,"XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325469446 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325469782 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325470110 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3325472912 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3325473305 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3325473683 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5" at 00000000-00009912-00000C17-3325479639 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\qt5core.dll" at 00000000-00009912-00000C17-3325481009 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3326055696 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3326056402 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3326072066 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3326072587 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\pythoncom310.dll" at 00000000-00009912-00000C17-3328757372 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3329012739 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3329018811 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\numpy.libs" at 00000000-00009912-00000C17-3329086782 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\numpy" at 00000000-00009912-00000C17-3329089450 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\numpy" at 00000000-00009912-00000C17-3329089893 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\numpy" at 00000000-00009912-00000C17-3329090336 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\numpy" at 00000000-00009912-00000C17-3329091365 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3329389926 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3329390339 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3329589227 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1" at 00000000-00009912-00000C17-3329589623 "XG-Team.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\scipy.libs" at 00000000-00009912-00000C17-332964309630:T842,"XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325469446 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325469782 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3325470110 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3326055696 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3326072066 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3329389926 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3329589227 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3329801998 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3332512279 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334096093 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334096994 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334255500 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334351412 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334359716 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334362034 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334446973 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3334451513 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3336200607 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3336201528 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3336272296 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3336273255 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-3336313962 "XG-Team.exe" queries volume information of "C:\" at 00000000-00009912-00000C17-333632694531:T10aa,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PIL (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\Qt (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\Qt5 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\iconengines (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platformthemes (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\printsupport (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\styles (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\Resource (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\certifi (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\charset_normalizer (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\cryptography\hazmat\bindings (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\cryptography\hazmat (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\cryptography (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\markupsafe (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\nacl (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "CreateDirectoryW" with parameter %TEMP%\onefile_9196_133917799527850553\numpy\_core (UID: 00000000-00009196)32:T3a22,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009196) "XG-Team.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\QtWidgets.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\sip.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\QtCore.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\QtGui.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_socket.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\select.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_ctypes.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\unicodedata.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\QtXml.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\QtSvg.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\win32api.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\win32gui.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\win32print.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter winspool.drv (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_win32sysloader.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\onefile_9196_133917799527850553\python3 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\pywintypes310.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter pythoncom310.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\pythoncom310.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\_core\_multiarray_umath.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\linalg\_umath_linalg.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_bz2.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_lzma.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PIL\_imaging.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\_lib\_ccallback_c.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\bit_generator.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_common.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_hashlib.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\mtrand.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_bounded_integers.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_mt19937.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_philox.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_pcg64.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_sfc64.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\random\_generator.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\charset_normalizer\md.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\charset_normalizer\md__mypyc.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\numpy\fft\_pocketfft_umath.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\ndimage\_nd_image.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_ufuncs.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_ufuncs_cxx.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_special_ufuncs.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_gufuncs.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_specfun.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_comb.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_fblas.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_flapack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_cythonized_array_utils.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\cython_lapack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_solve_toeplitz.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_decomp_lu_cython.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_matfuncs_sqrtm_triu.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_matfuncs_expm.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\cython_blas.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\linalg\_decomp_update.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\_sparsetools.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\_csparsetools.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_dsolve\_superlu.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_eigen\arpack\_arpack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_propack\_spropack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_propack\_dpropack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_propack\_cpropack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\linalg\_propack\_zpropack.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_shortest_path.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_tools.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_traversal.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_min_spanning_tree.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_flow.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_matching.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\sparse\csgraph\_reordering.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\special\_ellip_harm_2.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\scipy\ndimage\_ni_label.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_ssl.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\zstandard\backend_c.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\psutil\_psutil_windows.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\win32security.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter ntdsapi.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_queue.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_cffi_backend.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\pyinjector\injector.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\_uuid.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\nacl\_sodium.pyd (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\platforms\qwindows.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHCore.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qgif.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qicns.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qico.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qjpeg.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qsvg.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qtga.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qtiff.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qwbmp.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\imageformats\qwebp.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwrite.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdi32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\d3d9.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter ext-ms-win-core-resourcepolicy-l1-1-0.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00009912) "XG-Team.exe" called "LoadLibrary" with a parameter %TEMP%\ONEFIL~1\PyQt5\qt-plugins\iconengines\qsvgicon.dll (UID: 00000000-00009912) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010028) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010028) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010028) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00010028)33:Tac29,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009196) "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009196) "XG-Team.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_QtWidgets (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_sip (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_QtCore (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_QtGui (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_QtXml (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_QtSvg (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessDeniedAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessAllowedAceEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessAllowedObjectAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessDeniedAceEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAccessDeniedObjectAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAuditAccessAceEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddAuditAccessObjectAce (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorControl (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_win32api (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetComputerObjectNameW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLongPathNameA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetSystemFileCacheSize (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetDllDirectoryW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetSystemPowerState (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ChangeDisplaySettingsExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegRestoreKeyW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegSaveKeyExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegCreateKeyTransactedW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegOpenKeyTransactedW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegDeleteKeyTransactedW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegCopyTreeW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RegOverridePredefKey (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_win32gui (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLayeredWindowAttributes (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetMenuInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetMenuInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AngleArc (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PlgBlt (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetWorldTransform (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetWorldTransform (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ModifyWorldTransform (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CombineTransform (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter MaskBlt (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter TransparentBlt (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_win32print (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumFormsW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddFormW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DeleteFormW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetFormW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetFormW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddJobW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ScheduleJob (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumPortsW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnumMonitorsW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPrintProcessorDirectoryW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPrinterDriverDirectoryW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DeletePrinterDriverExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FlushPrinter (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetDefaultPrinterW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetDefaultPrinterW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__win32sysloader (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_pywintypes (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_pythoncom (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoGetCancelObject (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__multiarray_umath (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__umath_linalg (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__imaging (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ccallback_c (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_bit_generator (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__common (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_mtrand (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__bounded_integers (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__mt19937 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__philox (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__pcg64 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__sfc64 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__generator (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_md (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_md__mypyc (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__pocketfft_umath (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__nd_image (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ufuncs (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ufuncs_cxx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__special_ufuncs (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__gufuncs (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__specfun (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__comb (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__fblas (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__flapack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__cythonized_array_utils (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_cython_lapack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__solve_toeplitz (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__decomp_lu_cython (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__matfuncs_sqrtm_triu (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__matfuncs_expm (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_cython_blas (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__decomp_update (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__sparsetools (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__csparsetools (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__superlu (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__arpack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__spropack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__dpropack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__cpropack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__zpropack (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__shortest_path (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__tools (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__traversal (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__min_spanning_tree (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__flow (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__matching (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__reordering (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ellip_harm_2 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ni_label (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_backend_c (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__psutil_windows (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RtlIpv4AddressToStringA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetExtendedTcpTable (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetExtendedUdpTable (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosErrorNoTeb (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RtlIpv6AddressToStringA (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetActiveProcessorCount (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_win32security (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CryptEnumProvidersW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaRegisterLogonProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaConnectUntrusted (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaDeregisterLogonProcess (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaLookupAuthenticationPackage (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaEnumerateLogonSessions (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaGetLogonSessionData (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaFreeReturnBuffer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaCallAuthenticationPackage (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaRegisterPolicyChangeNotification (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LsaUnregisterPolicyChangeNotification (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ConvertSecurityDescriptorToStringSecurityDescriptorW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter ImpersonateAnonymousToken (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter IsTokenRestricted (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LogonUserExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter LogonUserExExW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter TranslateNameW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsBindW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsUnBindW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsGetSpnW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsWriteAccountSpnW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsFreeSpnArrayW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsCrackNamesW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListInfoForServerW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListDomainsInSiteW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListServersForDomainInSiteW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListServersInSiteW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListSitesW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsListRolesW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsFreeNameResultW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DsGetDcNameW (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter OPENSSL_Applink (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__rust (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__cffi_backend (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit_injector (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter PyInit__sodium (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter qt_plugin_instance (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AddClipboardFormatListener (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter RemoveClipboardFormatListener (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetDisplayAutoRotationPreferences (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetDisplayAutoRotationPreferences (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnableMouseInPointer (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerType (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerDeviceRects (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerTouchInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerFrameTouchInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerFrameTouchInfoHistory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerPenInfo (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetPointerPenInfoHistory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SkipPointerFrameMessages (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetAwarenessFromDpiAwarenessContext (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SystemParametersInfoForDpi (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter GetCharWidthI (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter Direct3DCreate9 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter CreateGameConfigStoreClient (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter FreeGameConfigStoreClient (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00009912) "XG-Team.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00009912) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00010028) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00010028)34:T654,Found reference to API "LockResource" (Indicator: "LockResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "?PyWinObject_FreeResourceId@@YAXPEA_W@Z" (Indicator: "FreeResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "?PyWinObject_FreeResourceIdA@@YAXPEAD@Z" (Indicator: "FreeResource"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp")35:T541,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")36:T845,"python310.dll" contains export function called "PyAIter_Check" at ordinal 1 "python310.dll" contains export function called "PyArg_Parse" at ordinal 2 "python310.dll" contains export function called "PyArg_ParseTuple" at ordinal 3 "python310.dll" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 4 "python310.dll" contains export function called "PyArg_UnpackTuple" at ordinal 5 "python310.dll" contains export function called "PyArg_VaParse" at ordinal 6 "python310.dll" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 7 "python310.dll" contains export function called "PyArg_ValidateKeywordArguments" at ordinal 8 "python310.dll" contains export function called "PyAsyncGen_New" at ordinal 9 "python310.dll" contains export function called "PyAsyncGen_Type" at ordinal 10 "python310.dll" contains export function called "PyBaseObject_Type" at ordinal 11 "python310.dll" contains export function called "PyBool_FromLong" at ordinal 12 "python310.dll" contains export function called "PyBool_Type" at ordinal 13 "python310.dll" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 14 "python310.dll" contains export function called "PyBuffer_FillInfo" at ordinal 15 "python310.dll" contains export function called "PyBuffer_FromContiguous" at ordinal 16 "python310.dll" contains export function called "PyBuffer_GetPointer" at ordinal 17 "python310.dll" contains export function called "PyBuffer_IsContiguous" at ordinal 18 "python310.dll" contains export function called "PyBuffer_Release" at ordinal 19 "python310.dll" contains export function called "PyBuffer_SizeFromFormat" at ordinal 20 "python310.dll" contains export function called "PyBuffer_ToContiguous" at ordinal 21 "python310.dll" contains export function called "PyByteArrayIter_Type" at ordinal 22 "python310.dll" contains export function called "PyByteArray_AsString" at ordinal 23 "python310.dll" contains export function called "PyByteArray_Concat" at ordinal 24 "python310.dll" contains export function called "PyByteArray_FromObject" at ordinal 2537:Tf75,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python310.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5quick.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5qml.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libeay32.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qwindows.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5network.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qminimal.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qoffscreen.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5multimedia.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pythoncom310.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "msvcp140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qwebp.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qwebgl.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5qmlmodels.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5dbus.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qjpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qtiff.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ssleay32.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5svg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qt5printsupport.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "concrt140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF38:T34f7,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffde6340000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffde6340000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffde6340000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "KERNEL32" at base 7ffde7ac0000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdb27f0000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "NTDLL.DLL" at base 7ffde8a30000 "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffde31b0000 "XG-Team.exe" loaded module "KERNEL32" at base 7ffde7ac0000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffde6340000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffde6340000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffde6340000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffde8480000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffde6340000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffde6340000 "XG-Team.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffde6340000 "XG-Team.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdb27f0000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffde4e10000 "XG-Team.exe" loaded module "KERNEL32.DLL" at base 7ffde7ac0000 "XG-Team.exe" loaded module "GDI32.DLL" at base 7ffde77c0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QTWIDGETS.PYD" at base 7ffda3d30000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\SIP.PYD" at base 7ffdb41a0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QTCORE.PYD" at base 7ffda28e0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QTGUI.PYD" at base 7ffda2670000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_SOCKET.PYD" at base 7ffdb4150000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SELECT.PYD" at base 7ffdc9c70000 "XG-Team.exe" loaded module "NTDLL.DLL" at base 7ffde8a30000 "XG-Team.exe" loaded module "KERNELBASE" at base 7ffde6340000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_CTYPES.PYD" at base 7ffdb3dd0000 "XG-Team.exe" loaded module "ADVAPI32" at base 7ffde7530000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\UNICODEDATA.PYD" at base 7ffdaece0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QTXML.PYD" at base 7ffdb3d60000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QTSVG.PYD" at base 7ffdb3d40000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\WIN32API.PYD" at base 7ffdb39c0000 "XG-Team.exe" loaded module "SECUR32.DLL" at base 7ffddb0e0000 "XG-Team.exe" loaded module "IMM32.DLL" at base 7ffde8480000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\WIN32GUI.PYD" at base 7ffdb2610000 "XG-Team.exe" loaded module "MSIMG32.DLL" at base 7ffdc89f0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\WIN32PRINT.PYD" at base 7ffdb3a20000 "XG-Team.exe" loaded module "WINSPOOL.DRV" at base 7ffdb2440000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_WIN32SYSLOADER.PYD" at base 7ffdc8770000 "XG-Team.exe" loaded module "%TEMP%\ONEFILE_9196_133917799527850553\PYTHON3" at base 219d25c0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYWINTYPES310.DLL" at base 7ffdb3250000 "XG-Team.exe" loaded module "PYTHONCOM310.DLL" at base 0 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYTHONCOM310.DLL" at base 7ffdae460000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffde3460000 "XG-Team.exe" loaded module "URLMON.DLL" at base 7ffdd38f0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\_CORE\_MULTIARRAY_UMATH.PYD" at base 7ffda2260000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\LINALG\_UMATH_LINALG.PYD" at base 7ffdb21e0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_BZ2.PYD" at base 7ffdb1e00000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_LZMA.PYD" at base 7ffdb1dd0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PIL\_IMAGING.PYD" at base 7ffda2010000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\_LIB\_CCALLBACK_C.PYD" at base 7ffdb1250000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\BIT_GENERATOR.PYD" at base 7ffdb1220000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_COMMON.PYD" at base 7ffdaeeb0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_HASHLIB.PYD" at base 7ffdafb90000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\MTRAND.PYD" at base 7ffdae0f0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_BOUNDED_INTEGERS.PYD" at base 7ffdaee60000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_MT19937.PYD" at base 7ffdaecc0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_PHILOX.PYD" at base 7ffdae0d0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_PCG64.PYD" at base 7ffdac870000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_SFC64.PYD" at base 7ffda1c90000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\RANDOM\_GENERATOR.PYD" at base 7ffda1bd0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\CHARSET_NORMALIZER\MD.PYD" at base 7ffdc1400000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\CHARSET_NORMALIZER\MD__MYPYC.PYD" at base 7ffda1ba0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NUMPY\FFT\_POCKETFFT_UMATH.PYD" at base 7ffda1b50000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\NDIMAGE\_ND_IMAGE.PYD" at base 7ffda1b10000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_UFUNCS.PYD" at base 7ffda1980000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_UFUNCS_CXX.PYD" at base 7ffda1710000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_SPECIAL_UFUNCS.PYD" at base 7ffda1600000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_GUFUNCS.PYD" at base 7ffda15a0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_SPECFUN.PYD" at base 7ffda1560000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_COMB.PYD" at base 7ffda1540000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_FBLAS.PYD" at base 7ffda1480000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_FLAPACK.PYD" at base 7ffda1290000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_CYTHONIZED_ARRAY_UTILS.PYD" at base 7ffda11f0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\CYTHON_LAPACK.PYD" at base 7ffda1160000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_SOLVE_TOEPLITZ.PYD" at base 7ffda1110000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_DECOMP_LU_CYTHON.PYD" at base 7ffda10c0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_MATFUNCS_SQRTM_TRIU.PYD" at base 7ffd9dba0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_MATFUNCS_EXPM.PYD" at base 7ffd9db20000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\CYTHON_BLAS.PYD" at base 7ffd9dad0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\LINALG\_DECOMP_UPDATE.PYD" at base 7ffd9da70000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\_SPARSETOOLS.PYD" at base 7ffd9d660000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\_CSPARSETOOLS.PYD" at base 7ffd9d590000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_DSOLVE\_SUPERLU.PYD" at base 7ffd9d490000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_EIGEN\ARPACK\_ARPACK.PYD" at base 7ffd9d210000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_PROPACK\_SPROPACK.PYD" at base 7ffd9d170000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_PROPACK\_DPROPACK.PYD" at base 7ffd9d0d0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_PROPACK\_CPROPACK.PYD" at base 7ffd9d010000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\LINALG\_PROPACK\_ZPROPACK.PYD" at base 7ffd9cf40000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_SHORTEST_PATH.PYD" at base 7ffd9ceb0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_TOOLS.PYD" at base 7ffd9ce70000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_TRAVERSAL.PYD" at base 7ffd9cdc0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_MIN_SPANNING_TREE.PYD" at base 7ffd9cd70000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_FLOW.PYD" at base 7ffd9cd10000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_MATCHING.PYD" at base 7ffd9ccb0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPARSE\CSGRAPH\_REORDERING.PYD" at base 7ffd9cc50000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\SPECIAL\_ELLIP_HARM_2.PYD" at base 7ffd9cc20000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\SCIPY\NDIMAGE\_NI_LABEL.PYD" at base 7ffd9cbb0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_SSL.PYD" at base 7ffd9cb80000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\ZSTANDARD\BACKEND_C.PYD" at base 7ffd9ca40000 "XG-Team.exe" loaded module "SHELL32" at base 7ffde6950000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PSUTIL\_PSUTIL_WINDOWS.PYD" at base 7ffda10a0000 "XG-Team.exe" loaded module "IPHLPAPI.DLL" at base 7ffde4980000 "XG-Team.exe" loaded module "NTDLL" at base 7ffde8a30000 "XG-Team.exe" loaded module "WTSAPI32.DLL" at base 7ffddf770000 "XG-Team.exe" loaded module "RPCRT4.DLL" at base 7ffde7690000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\WIN32SECURITY.PYD" at base 7ffd9c810000 "XG-Team.exe" loaded module "SECURITY.DLL" at base 219d2840000 "XG-Team.exe" loaded module "NTDSAPI.DLL" at base 7ffd9c7e0000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffde5310000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_QUEUE.PYD" at base 7ffdb4190000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffde5e50000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\CRYPTOGRAPHY\HAZMAT\BINDINGS\_RUST.PYD" at base 7ffd9c050000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_CFFI_BACKEND.PYD" at base 7ffd9c010000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYINJECTOR\INJECTOR.PYD" at base 7ffdb3dc0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\_UUID.PYD" at base 7ffdb33f0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\NACL\_SODIUM.PYD" at base 7ffd9bfb0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\PLATFORMS\QWINDOWS.DLL" at base 7ffd9be40000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 7ffde8280000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 7ffde79a0000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffde6950000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\STYLES\QWINDOWSVISTASTYLE.DLL" at base 7ffd9be10000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QGIF.DLL" at base 7ffdb3240000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QICNS.DLL" at base 7ffdb27d0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QICO.DLL" at base 7ffdb2770000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QJPEG.DLL" at base 7ffd9bda0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QSVG.DLL" at base 7ffdb2600000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QTGA.DLL" at base 7ffdb21d0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QTIFF.DLL" at base 7ffd9bd30000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QWBMP.DLL" at base 7ffdb1dc0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\IMAGEFORMATS\QWEBP.DLL" at base 7ffd9bca0000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\DWRITE.DLL" at base 7ffde1d60000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\GDI32.DLL" at base 7ffde77c0000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\D3D9.DLL" at base 7ffd9baf0000 "XG-Team.exe" loaded module "D3D10WARP.DLL" at base 7ffddfb10000 "XG-Team.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffde3910000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffdcaed0000 "XG-Team.exe" loaded module "%TEMP%\ONEFIL~1\PYQT5\QT-PLUGINS\ICONENGINES\QSVGICON.DLL" at base 7ffdaee50000 "XG-Team.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffde6830000 "cmd.exe" loaded module "KERNEL32" at base 7ffde7ac0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffde6340000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffde6340000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffde6340000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffde8480000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffde6340000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffde6340000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffde6340000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdb27f0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffde4ea000039:Tf78,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" was detected as "Microsoft Linker" and name: "Linker" "python310.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python310.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5quick.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5quick.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5qml.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5qml.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "libeay32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libeay32.dll" was detected as "Microsoft Linker" and name: "Linker" "qwindows.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qwindows.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5network.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5network.dll" was detected as "Microsoft Linker" and name: "Linker" "qminimal.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qminimal.dll" was detected as "Microsoft Linker" and name: "Linker" "qoffscreen.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qoffscreen.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5multimedia.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5multimedia.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "pythoncom310.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pythoncom310.dll" was detected as "Microsoft Linker" and name: "Linker" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" was detected as "Microsoft Linker" and name: "Linker" "msvcp140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140.dll" was detected as "Microsoft Linker" and name: "Linker" "qwebp.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qwebp.dll" was detected as "Microsoft Linker" and name: "Linker" "qwebgl.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qwebgl.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5qmlmodels.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5qmlmodels.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5dbus.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5dbus.dll" was detected as "Microsoft Linker" and name: "Linker" "qjpeg.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qjpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "qtiff.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qtiff.dll" was detected as "Microsoft Linker" and name: "Linker" "ssleay32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ssleay32.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5svg.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5svg.dll" was detected as "Microsoft Linker" and name: "Linker" "qt5printsupport.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qt5printsupport.dll" was detected as "Microsoft Linker" and name: "Linker" "concrt140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "concrt140.dll" was detected as "Microsoft Linker" and name: "Linker"3a:T757,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python310.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5quick.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5qml.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-1_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libeay32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qwindows.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5network.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qminimal.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qoffscreen.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5multimedia.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-1_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pythoncom310.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msvcp140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qwebp.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qwebgl.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5qmlmodels.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5dbus.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qjpeg.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qtiff.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ssleay32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5svg.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qt5printsupport.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "concrt140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"3b:T5e0,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has an executable section named ".text" "python310.dll" has an executable section named ".text" "qt5quick.dll" has an executable section named ".text" "qt5qml.dll" has an executable section named ".text" "libcrypto-1_1.dll" has an executable section named ".text" "libeay32.dll" has an executable section named ".text" "qwindows.dll" has an executable section named ".text" "qt5network.dll" has an executable section named ".text" "qminimal.dll" has an executable section named ".text" "qoffscreen.dll" has an executable section named ".text" "qt5multimedia.dll" has an executable section named ".text" "libssl-1_1.dll" has an executable section named ".text" "pythoncom310.dll" has an executable section named ".text" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has an executable section named ".text" "msvcp140.dll" has an executable section named ".text" "qwebp.dll" has an executable section named ".text" "qwebgl.dll" has an executable section named ".text" "qt5qmlmodels.dll" has an executable section named ".text" "qt5dbus.dll" has an executable section named ".text" "qjpeg.dll" has an executable section named ".text" "qtiff.dll" has an executable section named ".text" "ssleay32.dll" has an executable section named ".text" "qt5svg.dll" has an executable section named ".text" "qt5printsupport.dll" has an executable section named ".text" "concrt140.dll" has an executable section named ".text"3c:T8f2,Observed large number of imported APIs from "Qt5Core.dll" : "699" [Source: qt5quick.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "1582" [Source: qt5quick.dll] Observed large number of imported APIs from "Qt5Qml.dll" : "478" [Source: qt5quick.dll] Observed large number of imported APIs from "Qt5Core.dll" : "1049" [Source: qt5qml.dll] Observed large number of imported APIs from "Qt5Core.dll" : "562" [Source: qwindows.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "786" [Source: qwindows.dll] Observed large number of imported APIs from "Qt5Core.dll" : "820" [Source: qt5network.dll] Observed large number of imported APIs from "Qt5Core.dll" : "224" [Source: qminimal.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "266" [Source: qminimal.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "242" [Source: qoffscreen.dll] Observed large number of imported APIs from "Qt5Core.dll" : "352" [Source: qt5multimedia.dll] Observed large number of imported APIs from "libcrypto-1_1.dll" : "435" [Source: libssl-1_1.dll] Observed large number of imported APIs from "Qt5Core.dll" : "381" [Source: qwebgl.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "315" [Source: qwebgl.dll] Observed large number of imported APIs from "Qt5Core.dll" : "319" [Source: qt5qmlmodels.dll] Observed large number of imported APIs from "Qt5Qml.dll" : "223" [Source: qt5qmlmodels.dll] Observed large number of imported APIs from "Qt5Core.dll" : "410" [Source: qt5dbus.dll] Observed large number of imported APIs from "Qt5Core.dll" : "267" [Source: qt5svg.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "274" [Source: qt5svg.dll] Observed large number of imported APIs from "Qt5Core.dll" : "202" [Source: qt5printsupport.dll] Observed large number of imported APIs from "Qt5Gui.dll" : "299" [Source: qt5printsupport.dll] Observed large number of imported APIs from "Qt5Widgets.dll" : "411" [Source: qt5printsupport.dll] Observed large number of imported APIs from "Qt5Core.dll" : "203" [Source: dsengine.dll] Observed large number of imported APIs from "Qt5Multimedia.dll" : "270" [Source: dsengine.dll] Observed large number of imported APIs from "Qt5Core.dll" : "205" [Source: qt5websockets.dll]3d:T5cf,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has an writable section named ".data" "python310.dll" has an writable section named ".data" "python310.dll" has an writable section named "PyRuntim" "qt5quick.dll" has an writable section named ".data" "qt5qml.dll" has an writable section named ".data" "libcrypto-1_1.dll" has an writable section named ".data" "libeay32.dll" has an writable section named ".data" "qwindows.dll" has an writable section named ".data" "qt5network.dll" has an writable section named ".data" "qminimal.dll" has an writable section named ".data" "qoffscreen.dll" has an writable section named ".data" "qt5multimedia.dll" has an writable section named ".data" "libssl-1_1.dll" has an writable section named ".data" "pythoncom310.dll" has an writable section named ".data" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has an writable section named ".data" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has an writable section named ".didat" "msvcp140.dll" has an writable section named ".data" "msvcp140.dll" has an writable section named ".didat" "qwebp.dll" has an writable section named ".data" "qwebgl.dll" has an writable section named ".data" "qt5qmlmodels.dll" has an writable section named ".data" "qt5dbus.dll" has an writable section named ".data" "qjpeg.dll" has an writable section named ".data" "qtiff.dll" has an writable section named ".data" "ssleay32.dll" has an writable section named ".data"3e:T348b,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000cab8,add rsp, 0x28,jmp 0x14000c6f0,int3 ,int3 ,sub rsp, 0x28,call 0x14000d168,test eax, eax,je 0x14000c8a6,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000c899,cmp rcx, rax,je 0x14000c8ad,xor eax, eax,lock cmpxchg qword ptr [rip + 0x227d4], rcx,jne 0x14000c894,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000c8a8,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x14000c8c3,mov byte ptr [rip + 0x227bd], 1,call 0x14000ce9c," "python310.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18017c60d,call 0x18017c62c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18017c4b8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x25f9c8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18017c6c3," "qt5quick.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18024fe6d,call 0x180250328,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18024fd18,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r9d, ebx," "qt5qml.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180245001,call 0x1802454e8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180244eac,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x575c4],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x49e9],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "libcrypto-1_1.dll" file has an entrypoint instructions - "jmp 0x180247328,jmp 0x180223bc0,jmp 0x180234780,jmp 0x1801fd910,jmp 0x1801e8a00,jmp 0x1800a72e0,jmp 0x1801b8530,jmp 0x18019e060,jmp 0x18015ebb0,jmp 0x18019f570,jmp 0x1800dfa90,jmp 0x1801f94a0,jmp 0x1801b2e70,jmp 0x18019dfc0,jmp 0x18010c640,jmp 0x18021e8e0,jmp 0x180213be0,jmp 0x180235ea0,jmp 0x1801c25b0,jmp 0x180247820," "libeay32.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1801177d5,call 0x1801177f4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180117680,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0xb88c0],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18011788b," "qwindows.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800f2b55,call 0x1800f3154,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800f2a00,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x170b],mov rcx, rbx,call qword ptr [rip + 0x170a],call qword ptr [rip + 0x16f4],mov rcx, rax," "qt5network.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800dafa9,call 0x1800db488,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800dae54,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x22cac],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x4a09],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "qminimal.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18008db29,call 0x18008e3ac,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18008d9d4,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x18008db68,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx," "qoffscreen.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18007d86d,call 0x18007e0f0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18007d718,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x18007d8ac,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx," "qt5multimedia.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18005a805,call 0x18005ace4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18005a6b0,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x1b670],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x62c5],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "libssl-1_1.dll" file has an entrypoint instructions - "jmp 0x18006f5f8,jmp 0x180025a80,jmp 0x18002b0a0,jmp 0x180008dc0,jmp 0x18004c5c0,jmp 0x18006fff4,jmp 0x18005adb0,jmp 0x18001ac20,jmp 0x18002fb20,jmp 0x180067bd0,jmp 0x1800339a0,jmp 0x180023440,jmp 0x18003afb0,jmp 0x18002be20,jmp 0x18004ccc0,jmp 0x180054960,jmp 0x18001c3a0,jmp 0x180070104,jmp 0x18003ced0,jmp 0x18002b260," "pythoncom310.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180058755,call 0x1800593d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800585dc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x38cb],mov rcx, rbx,call qword ptr [rip + 0x38ca],call qword ptr [rip + 0x38b4],mov rcx, rax," "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18004d441,call 0x18004d954,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18004d2ec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x4c67],mov rcx, rbx,call qword ptr [rip + 0x4c66],call qword ptr [rip + 0x4ba0],mov rcx, rax," "msvcp140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800522c1,call 0x180052774,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18005216c,int3 ,int3 ,int3 ,jmp 0x18005294c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2ddf],mov rcx, rbx,call qword ptr [rip + 0x2dde]," "qwebp.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180064895,call 0x180064d28,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180064740,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x9b11],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qwebgl.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180043b29,call 0x18004407c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800439d4,int3 ,int3 ,int3 ,jmp 0x1800430cc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x10,mov qword ptr [rsp], r10," "qt5qmlmodels.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180042b85,call 0x1800431bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180042a30,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x149b],mov rcx, rbx,call qword ptr [rip + 0x149a],call qword ptr [rip + 0x1484],mov rcx, rax," "qt5dbus.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180045cad,call 0x180046194,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180045b58,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x9b08],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x2b2d],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "qjpeg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800369c1,call 0x180036ce0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18003686c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x27ff5],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qtiff.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180032d65,call 0x18003339c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180032c10,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x23671],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "ssleay32.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18003b7fd,call 0x18003b81c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18003b6a8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1a848],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18003b8b3," "qt5svg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18002e8b5,call 0x18002ed78,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18002e760,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x6311],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qt5printsupport.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001e115,call 0x18001e74c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001dfc0,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x10d31],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "concrt140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18002d081,call 0x18002d53c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18002cf2c,int3 ,int3 ,int3 ,jmp 0x18002d7ee,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x207f],mov rcx, rbx,"3f:T405,Raw size of ".rsrc" is "0x33dfa00" greater than 0x100000 Raw size of ".text" is "0x235600" greater than 0x100000 Raw size of ".rdata" is "0x1a4400" greater than 0x100000 Raw size of ".text" is "0x250400" greater than 0x100000 Raw size of ".rdata" is "0x161800" greater than 0x100000 Raw size of ".text" is "0x245e00" greater than 0x100000 Raw size of ".text" is "0x24ea00" greater than 0x100000 Raw size of ".text" is "0x117000" greater than 0x100000 Raw size of ".text" is "0x2cc400" greater than 0x100000 Raw size of ".rdata" is "0x14ce00" greater than 0x100000 Raw size of ".text" is "0x3d5000" greater than 0x100000 Raw size of ".text" is "0x325e00" greater than 0x100000 Raw size of ".text" is "0x12a000" greater than 0x100000 Raw size of ".text" is "0x152a00" greater than 0x100000 Raw size of ".text" is "0x1a2e00" greater than 0x100000 Raw size of ".text" is "0x1dfc00" greater than 0x100000 Raw size of ".text" is "0x110600" greater than 0x100000 Raw size of ".rdata" is "0x109000" greater than 0x10000040:T44d,Virtual size of ".rsrc" is "0x33df9ec" greater than 0x100000 Virtual size of ".text" is "0x235462" greater than 0x100000 Virtual size of ".rdata" is "0x1a42ac" greater than 0x100000 Virtual size of ".text" is "0x25020f" greater than 0x100000 Virtual size of ".rdata" is "0x161706" greater than 0x100000 Virtual size of ".text" is "0x245c8c" greater than 0x100000 Virtual size of ".text" is "0x24e8d4" greater than 0x100000 Virtual size of ".text" is "0x116f73" greater than 0x100000 Virtual size of ".text" is "0x2cc3d8" greater than 0x100000 Virtual size of ".rdata" is "0x14cd8e" greater than 0x100000 Virtual size of ".text" is "0x3d4ed0" greater than 0x100000 Virtual size of ".text" is "0x325ca8" greater than 0x100000 Virtual size of ".text" is "0x129f4f" greater than 0x100000 Virtual size of ".text" is "0x15287e" greater than 0x100000 Virtual size of ".text" is "0x1a2c88" greater than 0x100000 Virtual size of ".text" is "0x1dfba0" greater than 0x100000 Virtual size of ".text" is "0x110540" greater than 0x100000 Virtual size of ".rdata" is "0x108e80" greater than 0x10000041:T54a,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has high imagebase "0x140000000" "python310.dll" has high imagebase "0x180000000" "qt5quick.dll" has high imagebase "0x180000000" "qt5qml.dll" has high imagebase "0x180000000" "libcrypto-1_1.dll" has high imagebase "0x180000000" "libeay32.dll" has high imagebase "0x180000000" "qwindows.dll" has high imagebase "0x180000000" "qt5network.dll" has high imagebase "0x180000000" "qminimal.dll" has high imagebase "0x180000000" "qoffscreen.dll" has high imagebase "0x180000000" "qt5multimedia.dll" has high imagebase "0x180000000" "libssl-1_1.dll" has high imagebase "0x180000000" "pythoncom310.dll" has high imagebase "0x180000000" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has high imagebase "0x180000000" "msvcp140.dll" has high imagebase "0x180000000" "qwebp.dll" has high imagebase "0x180000000" "qwebgl.dll" has high imagebase "0x180000000" "qt5qmlmodels.dll" has high imagebase "0x180000000" "qt5dbus.dll" has high imagebase "0x180000000" "qjpeg.dll" has high imagebase "0x180000000" "qtiff.dll" has high imagebase "0x180000000" "ssleay32.dll" has high imagebase "0x180000000" "qt5svg.dll" has high imagebase "0x180000000" "qt5printsupport.dll" has high imagebase "0x180000000" "concrt140.dll" has high imagebase "0x180000000"42:T8ee,"XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NL-NL") "XG-Team.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO")43:T77ef,"qt5gui.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5gui.dll]- [targetUID: 00000000-00009196] "libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll]- [targetUID: 00000000-00009196] "libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy.libs\libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll]- [targetUID: 00000000-00009196] "qt5widgets.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5widgets.dll]- [targetUID: 00000000-00009196] "qt5core.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5core.dll]- [targetUID: 00000000-00009196] "XG-Team.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\XG-Team.exe]- [targetUID: 00000000-00009196] "python310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\python310.dll]- [targetUID: 00000000-00009196] "qt5quick.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5quick.dll]- [targetUID: 00000000-00009196] "qt5qml.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qml.dll]- [targetUID: 00000000-00009196] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libcrypto-1_1.dll]- [targetUID: 00000000-00009196] "libeay32.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libeay32.dll]- [targetUID: 00000000-00009196] "qwindows.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwindows.dll]- [targetUID: 00000000-00009196] "qt5network.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5network.dll]- [targetUID: 00000000-00009196] "qminimal.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qminimal.dll]- [targetUID: 00000000-00009196] "qoffscreen.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00009196] "qt5multimedia.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5multimedia.dll]- [targetUID: 00000000-00009196] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libssl-1_1.dll]- [targetUID: 00000000-00009196] "pythoncom310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pythoncom310.dll]- [targetUID: 00000000-00009196] "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll]- [targetUID: 00000000-00009196] "msvcp140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\msvcp140.dll]- [targetUID: 00000000-00009196] "qwebp.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00009196] "qwebgl.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwebgl.dll]- [targetUID: 00000000-00009196] "qt5qmlmodels.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qmlmodels.dll]- [targetUID: 00000000-00009196] "qt5dbus.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5dbus.dll]- [targetUID: 00000000-00009196] "qjpeg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00009196] "qtiff.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00009196] "ssleay32.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\ssleay32.dll]- [targetUID: 00000000-00009196] "qt5svg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5svg.dll]- [targetUID: 00000000-00009196] "qt5printsupport.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5printsupport.dll]- [targetUID: 00000000-00009196] "concrt140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\concrt140.dll]- [targetUID: 00000000-00009196] "dsengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\dsengine.dll]- [targetUID: 00000000-00009196] "cacert.pem" has type "ASCII text"- Location: [%TEMP%\onefile_9196_133917799527850553\certifi\cacert.pem]- [targetUID: 00000000-00009196] "qt5xml.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5xml.dll]- [targetUID: 00000000-00009196] "wmfengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\wmfengine.dll]- [targetUID: 00000000-00009196] "qt5websockets.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5websockets.dll]- [targetUID: 00000000-00009196] "qwindowsvistastyle.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll]- [targetUID: 00000000-00009196] "pywintypes310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pywintypes310.dll]- [targetUID: 00000000-00009196] "libsf_error_state.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libsf_error_state.dll]- [targetUID: 00000000-00009196] "qxdgdesktopportal.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll]- [targetUID: 00000000-00009196] "qtmedia_audioengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll]- [targetUID: 00000000-00009196] "python3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 2 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\python3.dll]- [targetUID: 00000000-00009196] "windowsprintersupport.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll]- [targetUID: 00000000-00009196] "qicns.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qicns.dll]- [targetUID: 00000000-00009196] "qsvgicon.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00009196] "qgif.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qgif.dll]- [targetUID: 00000000-00009196] "qico.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qico.dll]- [targetUID: 00000000-00009196] "qsvg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qsvg.dll]- [targetUID: 00000000-00009196] "msvcp140_1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\msvcp140_1.dll]- [targetUID: 00000000-00009196] "qtga.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qtga.dll]- [targetUID: 00000000-00009196] "qwbmp.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qwbmp.dll]- [targetUID: 00000000-00009196] "_rust.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\cryptography\hazmat\bindings\_rust.pyd]- [targetUID: 00000000-00009196] "QtWidgets.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtWidgets.pyd]- [targetUID: 00000000-00009196] "_sparsetools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\_sparsetools.pyd]- [targetUID: 00000000-00009196] "_multiarray_umath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\_core\_multiarray_umath.pyd]- [targetUID: 00000000-00009196] "QtGui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtGui.pyd]- [targetUID: 00000000-00009196] "QtCore.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtCore.pyd]- [targetUID: 00000000-00009196] "_imaging.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imaging.pyd]- [targetUID: 00000000-00009196] "_ufuncs_cxx.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ufuncs_cxx.pyd]- [targetUID: 00000000-00009196] "_flapack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_flapack.pyd]- [targetUID: 00000000-00009196] "_ufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ufuncs.pyd]- [targetUID: 00000000-00009196] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\unicodedata.pyd]- [targetUID: 00000000-00009196] "pypocketfft.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\fft\_pocketfft\pypocketfft.pyd]- [targetUID: 00000000-00009196] "_special_ufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_special_ufuncs.pyd]- [targetUID: 00000000-00009196] "_arpack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_eigen\arpack\_arpack.pyd]- [targetUID: 00000000-00009196] "_csparsetools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\_csparsetools.pyd]- [targetUID: 00000000-00009196] "_generator.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_generator.pyd]- [targetUID: 00000000-00009196] "_fblas.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_fblas.pyd]- [targetUID: 00000000-00009196] "_cffi.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\zstandard\_cffi.pyd]- [targetUID: 00000000-00009196] "mtrand.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\mtrand.pyd]- [targetUID: 00000000-00009196] "_traversal.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_traversal.pyd]- [targetUID: 00000000-00009196] "_cpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_cpropack.pyd]- [targetUID: 00000000-00009196] "_zpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_zpropack.pyd]- [targetUID: 00000000-00009196] "_sobol_direction_numbers.npz" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\stats\_sobol_direction_numbers.npz]- [targetUID: 00000000-00009196] "_cythonized_array_utils.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_cythonized_array_utils.pyd]- [targetUID: 00000000-00009196] "_spropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_spropack.pyd]- [targetUID: 00000000-00009196] "_dpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_dpropack.pyd]- [targetUID: 00000000-00009196] "_superlu.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_dsolve\_superlu.pyd]- [targetUID: 00000000-00009196] "cython_lapack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\cython_lapack.pyd]- [targetUID: 00000000-00009196] "backend_c.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\zstandard\backend_c.pyd]- [targetUID: 00000000-00009196] "_shortest_path.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_shortest_path.pyd]- [targetUID: 00000000-00009196] "_matfuncs_expm.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_matfuncs_expm.pyd]- [targetUID: 00000000-00009196] "_webp.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_webp.pyd]- [targetUID: 00000000-00009196] "_ni_label.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\ndimage\_ni_label.pyd]- [targetUID: 00000000-00009196] "_sodium.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\nacl\_sodium.pyd]- [targetUID: 00000000-00009196] "_decomp_update.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_decomp_update.pyd]- [targetUID: 00000000-00009196] "_gufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_gufuncs.pyd]- [targetUID: 00000000-00009196] "_matching.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_matching.pyd]- [targetUID: 00000000-00009196] "_flow.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_flow.pyd]- [targetUID: 00000000-00009196] "_reordering.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_reordering.pyd]- [targetUID: 00000000-00009196] "cython_blas.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\cython_blas.pyd]- [targetUID: 00000000-00009196] "_pocketfft_umath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\fft\_pocketfft_umath.pyd]- [targetUID: 00000000-00009196] "_solve_toeplitz.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_solve_toeplitz.pyd]- [targetUID: 00000000-00009196] "_imagingcms.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingcms.pyd]- [targetUID: 00000000-00009196] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_decimal.pyd]- [targetUID: 00000000-00009196] "_matfuncs_sqrtm_triu.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_matfuncs_sqrtm_triu.pyd]- [targetUID: 00000000-00009196] "_bounded_integers.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_bounded_integers.pyd]- [targetUID: 00000000-00009196] "_decomp_lu_cython.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_decomp_lu_cython.pyd]- [targetUID: 00000000-00009196] "_min_spanning_tree.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_min_spanning_tree.pyd]- [targetUID: 00000000-00009196] "_uarray.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\_uarray\_uarray.pyd]- [targetUID: 00000000-00009196] "QtXml.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtXml.pyd]- [targetUID: 00000000-00009196] "win32gui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32gui.pyd]- [targetUID: 00000000-00009196] "_specfun.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_specfun.pyd]- [targetUID: 00000000-00009196] "pyexpat.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pyexpat.pyd]- [targetUID: 00000000-00009196] "_cffi_backend.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_cffi_backend.pyd]- [targetUID: 00000000-00009196] "_tools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_tools.pyd]- [targetUID: 00000000-00009196] "_common.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_common.pyd]- [targetUID: 00000000-00009196] "_nd_image.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\ndimage\_nd_image.pyd]- [targetUID: 00000000-00009196] "bit_generator.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\bit_generator.pyd]- [targetUID: 00000000-00009196] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_ssl.pyd]- [targetUID: 00000000-00009196] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_lzma.pyd]- [targetUID: 00000000-00009196] "win32security.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32security.pyd]- [targetUID: 00000000-00009196] "win32api.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32api.pyd]- [targetUID: 00000000-00009196] "_elementtree.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_elementtree.pyd]- [targetUID: 00000000-00009196] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_ctypes.pyd]- [targetUID: 00000000-00009196] "sip.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\sip.pyd]- [targetUID: 00000000-00009196] "md__mypyc.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\charset_normalizer\md__mypyc.pyd]- [targetUID: 00000000-00009196] "QtSvg.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtSvg.pyd]- [targetUID: 00000000-00009196] "_ellip_harm_2.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ellip_harm_2.pyd]- [targetUID: 00000000-00009196] "_umath_linalg.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\linalg\_umath_linalg.pyd]- [targetUID: 00000000-00009196] "_pcg64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_pcg64.pyd]- [targetUID: 00000000-00009196] "_mt19937.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_mt19937.pyd]- [targetUID: 00000000-00009196] "_ccallback_c.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\_ccallback_c.pyd]- [targetUID: 00000000-00009196] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_bz2.pyd]- [targetUID: 00000000-00009196] "_philox.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_philox.pyd]- [targetUID: 00000000-00009196] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_socket.pyd]- [targetUID: 00000000-00009196] "win32print.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32print.pyd]- [targetUID: 00000000-00009196] "_psutil_windows.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00009196] "_asyncio.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_asyncio.pyd]- [targetUID: 00000000-00009196] "messagestream.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\messagestream.pyd]- [targetUID: 00000000-00009196] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_hashlib.pyd]- [targetUID: 00000000-00009196] "_multiarray_tests.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\_core\_multiarray_tests.pyd]- [targetUID: 00000000-00009196] "_sfc64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_sfc64.pyd]- [targetUID: 00000000-00009196] "_overlapped.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_overlapped.pyd]- [targetUID: 00000000-00009196] "_comb.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_comb.pyd]- [targetUID: 00000000-00009196] "_multiprocessing.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_multiprocessing.pyd]- [targetUID: 00000000-00009196] "_queue.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_queue.pyd]- [targetUID: 00000000-00009196] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\select.pyd]- [targetUID: 00000000-00009196] "_uuid.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_uuid.pyd]- [targetUID: 00000000-00009196] "_imagingmath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingmath.pyd]- [targetUID: 00000000-00009196] "injector.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pyinjector\injector.pyd]- [targetUID: 00000000-00009196] "_speedups.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\markupsafe\_speedups.pyd]- [targetUID: 00000000-00009196] "_win32sysloader.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_win32sysloader.pyd]- [targetUID: 00000000-00009196] "_imagingtk.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingtk.pyd]- [targetUID: 00000000-00009196] "md.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\charset_normalizer\md.pyd]- [targetUID: 00000000-00009196]44:T982,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\6129A08B7656C8D97A445E9B0A84CD6CB612F65F41AA76AD65B4628C539D6ADF.EXE"; Key: ""; Value: "")45:T12e9,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "6129A08B7656C8D97A445E9B0A84CD6CB612F65F41AA76AD65B4628C539D6ADF"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "30336ED4-E327-447C-9DE0-51B652C86108"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "32980F26-C8F5-5767-6B26-635B3FA83C61"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "")46:Tba5,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\imm32.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\CRYPTSP.DLL" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\WINDOWS\SYSTEM32\windows.storage.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\windows.storage.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\WINDOWS\SYSTEM32\wintypes.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\WinTypes.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\profapi.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\WINDOWS\SYSTEM32\profapi.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Windows\System32\profapi.dll" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\XG-Team.exe" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_asyncio.pyd" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_bz2.pyd" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_cffi_backend.pyd" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_ctypes.pyd" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_decimal.pyd" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\_elementtree.pyd"47:T94e,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" trying to access non-existent file "C:\profapi.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\CRYPTBASE.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\CRYPTBASE.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\Qt5Widgets.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\Qt5Gui.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\Qt5Core.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\python3.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\UxTheme.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\UxTheme.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\UxTheme.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\dwmapi.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\dwmapi.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\dwmapi.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\MSVCP140.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\MSVCP140_1.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\VCRUNTIME140_1.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\d3d11.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\d3d11.dll" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\d3d11.dll"48:T6c7,"XG-Team.exe" trying to access non-existent file "C:\PyQt5.pkg" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\__init__.cp310-win_amd64.pyd" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\__init__.pyd" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\__init__.py" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\__init__.pyw" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\__init__.pyc" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5.pkg" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\XG-Team.exe.Local\" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\WINSPOOL.DRV" "XG-Team.exe" trying to access non-existent file "C:\Users\fQM9VLA\AppData\Local\Temp\onefile_9196_133917799527850553\WINSPOOL.DRV" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\win32com" "XG-Team.exe" trying to access non-existent file "C:\not_existing" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\win32comext" "XG-Team.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ONEFIL~1\PyQt5\Qt5\qtlogging.ini" "XG-Team.exe" trying to access non-existent file "C:\ProgramData\XG-Data.json" "XG-Team.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun"49:T482,Heuristic match: "o_.mv" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0rr" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility" Pattern match: "hgcc.gnu.horg/bugsh" Pattern match: "http://www.w3.org/xml/1998/namespacendataentitynotationpublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "https://www.pcg-random.org/" Pattern match: "http://www.math.sci.hiroshima-u.ac.jp/m-mat/mt/jump/" Pattern match: "www.memtest86.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "https://pracrand.sourceforge.net/rng_engines.txt"4a:T8bb,"XG-Team.exe" called "FindFirstFileW" with parameter C:\*.* (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter $WinREAgent (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter 6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter DumpStack.log.tmp (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter hiberfil.sys (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter tempdir (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00009912) "XG-Team.exe" called "FindFirstFileW" with parameter %TEMP%\ONEFIL~1\*.* (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter certifi (UID: 00000000-00009912) "XG-Team.exe" called "FindNextFileW" with parameter charset_normalizer (UID: 00000000-00009912)4b:Td43,file/memory contains long string with (Indicator: "aes"; File: "_philox.pyd") Found string "?toBase64@QByteArray@@QEBA?AV1@XZ" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "?fromBase64@QByteArray@@SA?AV1@AEBV1@@Z" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "?toBase64@QByteArray@@QEBA?AV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_chacha20_poly1305" (Indicator: "chacha"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_192_cbc" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_128_ccm" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_256_cbc" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_128_cbc_hmac_sha1" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_256_cbc_hmac_sha1" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_128_cbc_hmac_sha256" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_256_cbc_hmac_sha256" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_128_cbc" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_256_gcm" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_256_ccm" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "EVP_aes_128_gcm" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "?qHash@@YAIAEBVFromBase64Result@QByteArray@@I@Z" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "?fromBase64Encoding@QByteArray@@SA?AVFromBase64Result@1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z" (Indicator: "base64"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "scipy_claesy_" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "scipy_zlaesy_" (Indicator: "aes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found string "316H7rRlr+/fKYIje2sGP1q7Vf9Q8g+7XFkyDRTNrJ9CGta/OrffGFqfUq3v84RLHIf86cqJaESvWJ3En7YEtbWaBkoe0G1h6zD8K+kZPTXhc+CtI4wSE" (Indicator: "aes"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp") Found string "Qs7ZngyzsHeXZJzA9KMuH5UHsBffMNsAGJZMoYFL3QRtU6M9/Aes1MU3guvklQgZ" (Indicator: "aes"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp")4c:T50f,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")4d:Tce7,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "__crtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp")4e:T48e,Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegSaveKeyW" (Indicator: "RegSaveKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegQueryValueW" (Indicator: "RegQueryValue"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")4f:T980,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00009196.00000002.279875.62AC1000.00000002.mdmp")50:T5b8,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VkKeyScanA" (Indicator: "VkKeyScan"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")51:T4f0,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")52:T893,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: python310.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: qwindows.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: qt5network.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _sparsetools.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _ufuncs_cxx.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _flapack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _ufuncs.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: pypocketfft.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _special_ufuncs.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _arpack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _cpropack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _zpropack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _spropack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _dpropack.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _gufuncs.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _uarray.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _nd_image.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: win32security.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: win32api.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: _psutil_windows.pyd] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: injector.pyd]53:T7de,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\onefile_9196_133917799527850553\XG-Team.exe" (Indicator: "\Device\"; Source: "00000000-00009196-00000BC0-3324650314") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00009912-00000BC1-3326394692") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00010028-00000BC0-3326467820") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.67A40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.67A40000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Indicator: "\Device\"; Source: "00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp")54:T10d2,Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "?_MakeAbsoluteSD@@YAHPEAXPEAPEAX@Z" (Indicator: "MakeAbsoluteSD"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "AddAuditAccessAce" (Indicator: "AddAuditAccessAce"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe")55:T256d,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: qt5network.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: qt5network.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: qt5network.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: qt5network.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: qt5network.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: qt5network.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: qt5network.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: qt5network.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: qt5network.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: qt5network.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: qt5network.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pythoncom310.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: pywintypes310.dll] Observed import api "AddAuditAccessAce" which can "add a system-audit access control entry (ACE) to a system access control list (ACL)" [Source: pywintypes310.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: pywintypes310.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: pywintypes310.dll] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: pywintypes310.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: pywintypes310.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: pywintypes310.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: pywintypes310.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: pywintypes310.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: pywintypes310.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: pywintypes310.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: pywintypes310.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: pywintypes310.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: pywintypes310.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: pywintypes310.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: pywintypes310.dll] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: pywintypes310.dll] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: pywintypes310.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: pywintypes310.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pywintypes310.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: pywintypes310.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: pywintypes310.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: pywintypes310.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: pywintypes310.dll] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: pywintypes310.dll] Observed import api "AdjustTokenGroups" which can "enable or disable groups already present in the specified access token" [Source: win32security.pyd] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: win32security.pyd] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: win32security.pyd] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: win32security.pyd] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: win32security.pyd] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: win32security.pyd] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: win32security.pyd] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: win32security.pyd] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: win32security.pyd] Observed import api "ImpersonateSelf" which can "obtain an access token that impersonates the security context of the calling process" [Source: win32security.pyd] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: win32security.pyd] Observed import api "MapGenericMask" which can "map the generic access rights in an access mask to specific and standard access rights" [Source: win32security.pyd] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: win32security.pyd] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: win32security.pyd] Observed import api "SetKernelObjectSecurity" which can "set the security of a kernel object" [Source: win32security.pyd] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: win32security.pyd] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: win32api.pyd] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: _psutil_windows.pyd] Observed import api "ImpersonateSelf" which can "obtain an access token that impersonates the security context of the calling process" [Source: _psutil_windows.pyd] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: _psutil_windows.pyd]56:Tae2,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\ONEFILE_9196_133917799527850553\XG-TEAM.EXE"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "XG-Team.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")57:T1424,"qt5gui.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5gui.dll]- [targetUID: 00000000-00009196] "libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll]- [targetUID: 00000000-00009196] "libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy.libs\libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll]- [targetUID: 00000000-00009196] "qt5widgets.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5widgets.dll]- [targetUID: 00000000-00009196] "qt5core.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5core.dll]- [targetUID: 00000000-00009196] "XG-Team.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\XG-Team.exe]- [targetUID: 00000000-00009196] "python310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\python310.dll]- [targetUID: 00000000-00009196] "qt5quick.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5quick.dll]- [targetUID: 00000000-00009196] "qt5qml.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qml.dll]- [targetUID: 00000000-00009196] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libcrypto-1_1.dll]- [targetUID: 00000000-00009196] "libeay32.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libeay32.dll]- [targetUID: 00000000-00009196] "qwindows.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwindows.dll]- [targetUID: 00000000-00009196] "qt5network.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5network.dll]- [targetUID: 00000000-00009196] "qminimal.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qminimal.dll]- [targetUID: 00000000-00009196] "qoffscreen.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00009196] "qt5multimedia.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5multimedia.dll]- [targetUID: 00000000-00009196] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libssl-1_1.dll]- [targetUID: 00000000-00009196] "pythoncom310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pythoncom310.dll]- [targetUID: 00000000-00009196] "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll]- [targetUID: 00000000-00009196] "msvcp140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\msvcp140.dll]- [targetUID: 00000000-00009196] "qwebp.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00009196] "qwebgl.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwebgl.dll]- [targetUID: 00000000-00009196] "qt5qmlmodels.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qmlmodels.dll]- [targetUID: 00000000-00009196] "qt5dbus.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5dbus.dll]- [targetUID: 00000000-00009196] "qjpeg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00009196]58:T7a7,"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has section name .text with entropy "6.505699908205351" "6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe" has section name .rsrc with entropy "7.998972528677422" "python310.dll" has section name .text with entropy "6.482045325395049" "python310.dll" has section name .pdata with entropy "6.342514768956248" "qt5quick.dll" has section name .text with entropy "6.382219426750117" "qt5quick.dll" has section name .pdata with entropy "6.284318036541121" "qt5qml.dll" has section name .text with entropy "6.33859370774462" "qt5qml.dll" has section name .pdata with entropy "6.281052834906999" "libeay32.dll" has section name .text with entropy "6.545726015296009" "libeay32.dll" has section name .rdata with entropy "6.628761135777381" "libeay32.dll" has section name .pdata with entropy "6.069263027576889" "qwindows.dll" has section name .text with entropy "6.447501223447783" "qwindows.dll" has section name .rdata with entropy "6.014844928297033" "qwindows.dll" has section name .pdata with entropy "6.116808499157829" "qt5network.dll" has section name .text with entropy "6.280191120811206" "qminimal.dll" has section name .text with entropy "6.466188756962242" "qminimal.dll" has section name .rdata with entropy "6.178225781022804" "qoffscreen.dll" has section name .text with entropy "6.463765422057715" "qoffscreen.dll" has section name .rdata with entropy "6.178808430660388" "qt5multimedia.dll" has section name .text with entropy "6.182373516588029" "pythoncom310.dll" has section name .text with entropy "6.16054806983241" "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has section name .text with entropy "6.367064585962361" "msvcp140.dll" has section name .text with entropy "6.3636213527753265" "qwebp.dll" has section name .text with entropy "6.509875965427601" "qwebp.dll" has section name .rdata with entropy "6.171458041671615"59:T3876,"!This program cannot be run in DOS mode.VJrnJRichsn.text`.rdata@.data.pdata@.rsrc@.relocx AVH@(Hc\$0Hl$8Ht$@H|$HH\$0HWAVAWH\$@Hl$HHt$PH A_A^_xmE3\$0Hl$8Ht$@HWAVAWH\$@3l$HHt$PH A_A^_\$0Ht$8HD$8A\$PHD$ D$ D$ !D$ "D$ #D$ $D$ %\$@Ht$HHx AVHL$PM\$0Hl$8Ht$@H|$HHt>H90\$0Hl$8Ht$@Hx AVH\$0Hl$8Ht$@H|$HHx AVHt$PA\$0Hl$8Ht$@H|$HHx AVHt$PL\$0Hl$8Ht$@H|$HHx AVHt$PL\$0Hl$8Ht$@H|$HHx ATAVAWHl$`L\$@Hl$HHt$PH|$XH A_A^A\\$0Hl$8Ht$@H< ~ s WHL$`LD$8L\$0HL$(H\$hHl$pHt$xHx AVHt$PL\$0Hl$8Ht$@H|$HHx AVHt$PL\$0Hl$8Ht$@H|$HHD$0LL$(LD$ 3\$PHx AVH<1H9{\$0Hl$8Ht$@H|$HHCHH+l$ VWAVHd$@H|$HL\$PHl$XH A^_^@UVWATAVH|$pHL9d$ptA^A\_^]F8d+L$PEl$0Ht$8Ht$8Hl$0H|$@H|%E3\$0HT$PLt$ WATAUAVAWHD$(Hd$ E3D$8Hl$0HL$ H\$PIA_A^A]A\_|$ AVIt$ H|$(A^L$(LD$ HD$PL\$0HL$XI\$0HD$XI\$0HD$XI\$0H@SUVWATAVAWHPA_A^A\_^][L$@HL$ HUSVWATAUAVAWHd$ HL$8HD$0MD$(LxA_A^A]A\_^[]T$ HL$ L49L9vFHH+mXA8H9H9\$(LL$ DL$(NT$ HmXE3\$(MD$ AT$pDD+CXHVWAVHl$PLl$PL|$XH\$`H0A^_^0A^_^t$ Ht$ Hw&Hcl$03F@E3l$0H\$8Ht$@H@VWH\$@Hd$PE3t$XL|$ MLc~4EF@L9`l$HDN@E3d$PLt$XH\$@L|$ H@VWATH\$XHl$`Hl$hE3t$(L|$ HLcv4ED$PLN@E3t$(Ll$hHl$`H\$XL|$ H0A\_^F@L9hD$PHt$PE3u8H9C(HcK4L\$0Ht$8HUSVWATAUAVAWHd$@EL$PID$@HD$@HD$@HF8H;T$PHT$PLT$PLO@D+D$(HEWA9G tH\$@E3A_A^A]A\_^[]T$HAl$PAD$ HL9o M9oht\$PLu_E3HcO4HD$@HUgL+L$@LEgL+L$@H|$ HT$PLL$@HD$@H$E+GXIL$@HL$@HL$@H\$(LL$@H|$0MD$(HE+GXIsOE3L$@H|$ AVHl$0H\$8Ht$@H|$HH|$ ATAVAWH\$@Hl$HHt$PH|$XH A_A^A\@SUVWATAUAVAWHD$hHT$PE3\$xDD$pI\$pHD$PIt$LHD$hHD$pHA_A^A]A\_^][d$PIT$8ND$ HD$PLH9w t=A8t$D$hMD$LHd$`Hl$xI} ffl$xIT$XA\$PD9t$@D$`LT$pE3D$DH;L$DIT$LE2\$PEL$0HD$(HT$PHD$`HD$`H;T$`Hl$@HD$HAl$@HUVWATAUAVAWHmodnarodHuespemosL3setybdetLarenegylAD8<8uA_A^A]A\_^]modnarodHuespemosL3setybdetLarenegyl3|$ AVAWHl$ Ht$(H|$0A_A^uXE3|$ AVH\$0Hl$8Ht$@H|$HHVWAUAVAWHD$ HT$`Hu'\$0Hl$8Ht$@H|$HHL$ UVWATAUAVAWHI9>uL$0Ht$0LL$0LL$0L@A_A^A]A\_^]\$ M\$@Ht$HHH;D$(tu>D$XHt$ AVH|$0LH19Hs$I;|$0H\$8Hl$@Ht$HH|$ AVH\$0Hl$8Ht$@H|$HHWAVAWHD$`H\$@Hl$HHt$PH A_A^_w Hcwu$H\$@Hl$HHt$PH A_A^_|$ AVH@8,;u\$0Hl$8Ht$@H|$HH\$0Ht$8Ht$ WAVAWHt$`M\$HHl$PHt$XH A_A^_HcK0\$0H\$0HT$PL\$0H\$0H\$0H\$0HWATAUAVAWH\$`Hl$hHt$pH0A_A^A]A\_t$ WAVAWHL$HLD$HH\$@Hl$PHt$XH A_A^_uDD8ZuespemosI3modnarodHarenegylHsetybdetHWATAUAVAWH\$`Hl$hHt$pH0A_A^A]A\_VWAVHL$HLD$HH\$@Hl$PH A^_^uDD8WAVAWHt6wO\$@Hl$HHt$PH A_A^_|#8B\$0Hl$8H|$@Ht'w>WAVAWH\$@Hl$HHt$PH A_A^_WATAWH:>u'\$@Hl$HHt$PH A_A\_x AUAVAWHl$HHt$PH|$XH A_A^A]WAVAWH\$@Hl$HHt$PH A_A^_WAVAWH\$@Hl$HHt$PH A_A^_D$PL\$0Ht$8Hx AUAVAWHl$HHt$PH|$XH A_A^A]x AVHt$PL\$0Hl$8Ht$@H|$HHx AVHt$PL\$0Hl$8Ht$@H|$HH\$(I;x AVH\$0Hl$8Ht$@H|$HH\$0HD$PL|$ AVHD$@@\$0Ht$8H|$HH\$@HVWAVH\$xH@A^_^\$0Ht$8HD$8HD$8HD$@H@SVWHT$`HL$hHT$`LL$0LL$pHL$(3@_^[\$ UHM H1E H3E H3E\$HHt!eHL$PH\$0Hl$8Ht$@HuxHcuTL+L$0LL$(HL$ 3L$PHD$PHD$@HD$H3\$0H\$0HntelAGenuDineIt(=`t!=p w$HT$ HD$ "D$ $\$(3t$0HT$ LD$XIT$8ID$XHS@H9SD$XE3D$@Hd$8HL9c0uH){8H){0D$@MD$(mD$(HL$ HD$(LL$@HL$8DL$0HL$@HD$8HD$0HD$(DL$ E3D$(HD$@HD$8HD$0HL$ HD$(MmXIcuhHcTUXE3]X@2d$ MU`E3F@L9FL$PMD$PHD$PHL$ IT$PH\$PHd$ ID$@HEOE+GXID$@HD$PID$PH;HcL$LHD$hH\$PDLcG(HG H9Al$xLH+C HK HcB|$0M9}o@M'LcD$(H+t;D+t6D+t1D;D$(H+D$(I+D$XID$PMT$@L|$0IL$HH\$XE3l$(HD$HIT$hML$(HL$PHD$ AD+GXH8Upu8UpuL$0HD$0ID$0Hd$`HD$XHl$PHt$HH\$@HD$8AL$pML$0HL$pHL$(HL$hHD$hHT$pHD$hID+CXHL$pI9u HD$`E3D$@It$8Ht$(HT$0HL$0@81T$0HL$0@81uD$`HT$@A:]u(It$ MtcA+tYA+tTA;tmA;tFA+tJA+L$HL]u(It$ MtbA+tXA+tSA;tlA;tEA+tZA+L$HL|\A8Z:]u'M|BA8ZuuDL|4A8\$0Hl$8Ht$@HuML\$0HoutC8auRMmuCC8tu A8t$ WAVAWHT$HLt@A+L$HHt,A+t>A+\$@Hl$PHt$XH A_A^_D$HI-uVI>u[I\$0H\$0Ht$8HuBM+\$0H|$8HuHM+\$0Ht$8HD$PLD$PL\$0Ht$8H@8:uA8:u\$0Hl$8Ht$@H\$0Ht$8H\$(L+@USWHWpH9]M7H3\$0Ht$8HL$(LD$ HL$(LD$ HL$(LD$ Hx AVHt*A+\$0Hl$8Ht$@H|$HH:]u3M\$0Hl$8Ht$@H:;t#WAVAWHtAA+\$@Hl$HHt$PH A_A^_|pA8[;]u[L|YA8[;>uDL|4A8[\$0Hl$8Ht$@HuML\$0H9outC8D9auRM9muCC8Dtu A8At$ WAVAWHT$HLt@A+L$HHt+A+t9A+\$@Hl$PHt$XH A_A^_D$HI:-uVI:>u[I\$0H\$0Ht$8HuCI+\$0Ht$8HuHM+\$0Ht$8HD$PLD$PL\$0Hl$8Ht$@H\$0Hl$8Ht$@H\$0Ht$8H\$(L+x ATAVAWHtpA+t?A+?]uHI?>u8It`A+?[uA\$@Hl$HHt$PH|$XH A_A^A\D$0H9D$PuD$0Hx AVHl$PIH9+u\$0Hl$8Ht$@H|$HHx AVLL;\$0D$0I+|$(Lt$ Mexpat_CAPIpyexpat.expat_CAPIpyexpat.expat_CAPI 1.1XML_PARAM_ENTITY_PARSING_ALWAYSXML_PARAM_ENTITY_PARSING_UNLESS_STANDALONEXML_PARAM_ENTITY_PARSING_NEVERnative_encodingUTF-8version_info(iii)EXPAT_VERSIONXMLParserTypeExpatErrorerrorxml.parsers.expat.ExpatErrorfeaturespyexpat.errorsXML_ERROR_NO_MEMORYXML_ERROR_SYNTAXXML_ERROR_NO_ELEMENTSXML_ERROR_INVALID_TOKENXML_ERROR_UNCLOSED_TOKENXML_ERROR_PARTIAL_CHARXML_ERROR_TAG_MISMATCHXML_ERROR_DUPLICATE_ATTRIBUTEXML_ERROR_JUNK_AFTER_DOC_ELEMENTXML_ERROR_PARAM_ENTITY_REFXML_ERROR_UNDEFINED_ENTITYXML_ERROR_RECURSIVE_ENTITY_REFXML_ERROR_ASYNC_ENTITYXML_ERROR_BAD_CHAR_REFXML_ERROR_BINARY_ENTITY_REFXML_ERROR_ATTRIBUTE_EXTERNAL_ENTITY_REFXML_ERROR_MISPLACED_XML_PIXML_ERROR_UNKNOWN_ENCODINGXML_ERROR_INCORRECT_ENCODINGXML_ERROR_UNCLOSED_CDATA_SECTIONXML_ERROR_EXTERNAL_ENTITY_HANDLINGXML_ERROR_NOT_STANDALONEXML_ERROR_UNEXPECTED_STATEXML_ERROR_ENTITY_DECLARED_IN_PEXML_ERROR_FEATURE_REQUIRES_XML_DTDXML_ERROR_CANT_CHANGE_FEATURE_ONCE_PARSINGXML_ERROR_UNBOUND_PREFIXXML_ERROR_UNDECLARING_PREFIXXML_ERROR_INCOMPLETE_PEXML_ERROR_XML_DECLXML_ERROR_TEXT_DECLXML_ERROR_PUBLICIDXML_ERROR_SUSPENDEDXML_ERROR_NOT_SUSPENDEDXML_ERROR_ABORTEDXML_ERROR_FINISHEDXML_ERROR_SUSPEND_PEConstants used to describe error conditions.XML_CQUANT_PLUSXML_CQUANT_REPXML_CQUANT_OPTXML_CQUANT_NONEXML_CTYPE_SEQXML_CTYPE_CHOICEXML_CTYPE_NAMEXML_CTYPE_MIXEDXML_CTYPE_ANYXML_CTYPE_EMPTY__doc__Constants used to interpret content model information.pyexpat.modelcodesmessagesno element foundout of memoryunclosed tokenillegal parameter entity referenceduplicate attributemismatched tagpartial characterreference to external entity in attributereference to binary entityreference to invalid character numberasynchronous entityrecursive entity referenceXML or text declaration not at start of entityerror in processing external entity referenceunclosed CDATA sectionencoding specified in XML declaration is incorrectdocument is not standaloneunbound prefixcannot change setting once parsing has begunrequested feature requires XML_DTD support in Expatentity declared in parameter entityunexpected parser state - please send a bug reportmust not undeclare prefixillegal character(s) in public idtext declaration not well-formedXML declaration not well-formedincomplete markup in parameter entityparser suspendedcannot suspend in external parameter entityparsing finishedparsing abortedparser not suspendedunknown encodingsyntax errorjunk after document elementundefined entitylinenooffsetcode%s: line %i column %inot well-formed (invalid token)utf-8(NN)strictreplaceComment(O&)multi-byte encodings are not supportedProcessingInstruction(NO&)EndNamespaceDeclCLOSEOPEN EXPAT_ENTITY_DEBUGEXPAT_ACCOUNTING_DEBUGD:\a\1\s\Modules\pyexpat.cDefaultHandlerExpandCharacterDataStartElementEndElementStartNamespaceDeclXML_ParserCreate failednamespace_separator must be at most one character omitted or Noneintern must be a dictionary ABORTINGNMTOKENSCDATAxml=http://www.w3.org/XML/1998/namespaceNDATAENTITYNOTATIONPUBLICPCDATASYSTEMDOCTYPEELEMENTIMPLIEDATTLISTversionUTF-16 !"#encodingParseParseFileSetBaseExternalEntityParserCreateUseForeignDTDinternParserCreateGetBaseGetInputContextSetParamEntityParsingErrorCodeErrorLineNumberErrorColumnNumberErrorByteIndexCurrentLineNumberCurrentColumnNumberCurrentByteIndexbuffer_sizebuffer_textbuffer_usednamespace_prefixesordered_attributesspecified_attributespyexpat.xmlparserErrorStringpyexpatStartElementHandlerEndElementHandlerProcessingInstructionHandlerCharacterDataHandlerUnparsedEntityDeclHandlerNotationDeclHandlerStartNamespaceDeclHandlerEndNamespaceDeclHandlerCommentHandlerStartCdataSectionHandlerEndCdataSectionHandlerDefaultHandlerNotStandaloneHandlerExternalEntityRefHandlerStartDoctypeDeclHandlerEndDoctypeDeclHandlerEntityDeclHandlerXmlDeclHandlerElementDeclHandlerAttlistDeclHandlerSkippedEntityHandlerGetInputContext($self, /)Return the untranslated text of the input that caused the current event.If the event was generated by a large amount of text (such as a start tagfor an element with many attributes), not all of the text may be available.Parse($self, data, isfinal=False, /)Parse XML data.`isfinal' should be true at end of input.ParseFile($self, file, /)Parse XML data from file-like object.SetBase($self, base, /)Set the base URL for the parser.ParserCreate($module, /, encoding=None, namespace_separator=None, intern=)Return a new XML parser object.UseForeignDTD($self, flag=True, /)Allows the application to provide an artificial external subset if one is not specified as part of the document instance.This readily allows the use of a 'default' document type controlled by theapplication, while still getting the advantage of providing document typeinformation to the parser. 'flag' defaults to True if not provided.ExternalEntityParserCreate($self, context, encoding=, /)Create a parser for parsing an external entity based on the information passed to the ExternalEntityRefHandler.GetBase($self, /)Return base URL string for the parser.ErrorString($module, code, /)Returns string error for given number.Python wrapper for Expat parser.XML parserSetParamEntityParsing($self, flag, /)Controls parsing of parameter entities (including the external DTD subset).Possible flag values are XML_PARAM_ENTITY_PARSING_NEVER,XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE andXML_PARAM_ENTITY_PARSING_ALWAYS. Returns true if setting the flagwas successful.http://www.w3.org/2000/xmlns/http://www.w3.org/XML/1998/namespaceNMTOKENIDREFSNMTOKENSCDATAENTITIESIDREF !"# !"# !"# !"#$%UTF-16LEUTF-8CDATA[ !"#UTF-16BE !"#US-ASCIIISO-8859-1 !"#expat_2.5.0argumentembedded null characterstr or Noneargument 1argument 2encodingnamespace_separatorargument 'encoding'argument 'namespace_separator'(NNNNN)UnparsedEntityDeclNiNNNNNEntityDecl(O&O&i)XmlDecl(iiO&N)ElementDecl(NNO&O&i)AttlistDeclSkippedEntity(NNNN)NotationDeclStartCdataSectionEndCdataSectionDefaultNotStandalone(O&NNN)ExternalEntityRef(NNNi)StartDoctypeDeclEndDoctypeDeclread() did not return a bytes object (type=%.400s)read() returned too much data: %i bytes requested %zd returnedreadargument must have 'read' attributeCannot delete attributebuffer_size must be an integerbuffer_size must be greater than zeroIDREFSENTITYNMTOKENIDREFk"F/ca./r/Q'q\s3jvEMPTYNOTATION(ENTITIESREQUIREDINCLUDEIGNOREFIXEDCDATA[ !"# !"# !"# !"# !"#CDATA[ !"#standalone !"#EXPAT_ENTROPY_DEBUGexpat: Entropy: %s --> 0x%0*lx (%lu bytes)rand_sfallback(4)reserved prefix (xml) must not be undeclared or bound to another namespace namereserved prefix (xmlns) must not be declared or undeclaredprefix must not be bound to one of the reserved namespace namesinvalid argumenta successful prior call to function XML_GetBuffer is requiredlimit on input amplification factor (from DTD and entities) breachedsizeof(XML_Char)sizeof(XML_LChar)XML_DTDXML_CONTEXT_BYTESXML_NSXML_BLAP_MAX_AMPXML_BLAP_ACT_THRESexpat: Accounting(%p): Direct %10I64u indirect %10I64u amplification %8.2f%s (+%6I64d bytes %s|%d, xmlparse.c:%d) %*s"[..]expat: Entities(%p): Count %9d, depth %2d/%2d %*s%s%s; %s length %d (xmlparse.c:%d)\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8"5a:T7677,"qt5gui.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5gui.dll]- [targetUID: 00000000-00009196] "libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll]- [targetUID: 00000000-00009196] "libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy.libs\libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll]- [targetUID: 00000000-00009196] "qt5widgets.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5widgets.dll]- [targetUID: 00000000-00009196] "qt5core.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5core.dll]- [targetUID: 00000000-00009196] "XG-Team.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\XG-Team.exe]- [targetUID: 00000000-00009196] "python310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\python310.dll]- [targetUID: 00000000-00009196] "qt5quick.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5quick.dll]- [targetUID: 00000000-00009196] "qt5qml.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qml.dll]- [targetUID: 00000000-00009196] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libcrypto-1_1.dll]- [targetUID: 00000000-00009196] "libeay32.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libeay32.dll]- [targetUID: 00000000-00009196] "qwindows.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwindows.dll]- [targetUID: 00000000-00009196] "qt5network.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5network.dll]- [targetUID: 00000000-00009196] "qminimal.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qminimal.dll]- [targetUID: 00000000-00009196] "qoffscreen.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00009196] "qt5multimedia.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5multimedia.dll]- [targetUID: 00000000-00009196] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libssl-1_1.dll]- [targetUID: 00000000-00009196] "pythoncom310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pythoncom310.dll]- [targetUID: 00000000-00009196] "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy.libs\msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll]- [targetUID: 00000000-00009196] "msvcp140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\msvcp140.dll]- [targetUID: 00000000-00009196] "qwebp.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00009196] "qwebgl.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platforms\qwebgl.dll]- [targetUID: 00000000-00009196] "qt5qmlmodels.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5qmlmodels.dll]- [targetUID: 00000000-00009196] "qt5dbus.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5dbus.dll]- [targetUID: 00000000-00009196] "qjpeg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00009196] "qtiff.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00009196] "ssleay32.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\ssleay32.dll]- [targetUID: 00000000-00009196] "qt5svg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5svg.dll]- [targetUID: 00000000-00009196] "qt5printsupport.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5printsupport.dll]- [targetUID: 00000000-00009196] "concrt140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\concrt140.dll]- [targetUID: 00000000-00009196] "dsengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\dsengine.dll]- [targetUID: 00000000-00009196] "qt5xml.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5xml.dll]- [targetUID: 00000000-00009196] "wmfengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\wmfengine.dll]- [targetUID: 00000000-00009196] "qt5websockets.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\qt5websockets.dll]- [targetUID: 00000000-00009196] "qwindowsvistastyle.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll]- [targetUID: 00000000-00009196] "pywintypes310.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pywintypes310.dll]- [targetUID: 00000000-00009196] "libsf_error_state.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\libsf_error_state.dll]- [targetUID: 00000000-00009196] "qxdgdesktopportal.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll]- [targetUID: 00000000-00009196] "qtmedia_audioengine.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll]- [targetUID: 00000000-00009196] "python3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 2 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\python3.dll]- [targetUID: 00000000-00009196] "windowsprintersupport.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll]- [targetUID: 00000000-00009196] "qicns.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qicns.dll]- [targetUID: 00000000-00009196] "qsvgicon.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00009196] "qgif.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qgif.dll]- [targetUID: 00000000-00009196] "qico.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qico.dll]- [targetUID: 00000000-00009196] "qsvg.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qsvg.dll]- [targetUID: 00000000-00009196] "msvcp140_1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\msvcp140_1.dll]- [targetUID: 00000000-00009196] "qtga.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qtga.dll]- [targetUID: 00000000-00009196] "qwbmp.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\qt-plugins\imageformats\qwbmp.dll]- [targetUID: 00000000-00009196] "_rust.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\cryptography\hazmat\bindings\_rust.pyd]- [targetUID: 00000000-00009196] "QtWidgets.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtWidgets.pyd]- [targetUID: 00000000-00009196] "_sparsetools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\_sparsetools.pyd]- [targetUID: 00000000-00009196] "_multiarray_umath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\_core\_multiarray_umath.pyd]- [targetUID: 00000000-00009196] "QtGui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtGui.pyd]- [targetUID: 00000000-00009196] "QtCore.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtCore.pyd]- [targetUID: 00000000-00009196] "_imaging.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imaging.pyd]- [targetUID: 00000000-00009196] "_ufuncs_cxx.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ufuncs_cxx.pyd]- [targetUID: 00000000-00009196] "_flapack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_flapack.pyd]- [targetUID: 00000000-00009196] "_ufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ufuncs.pyd]- [targetUID: 00000000-00009196] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\unicodedata.pyd]- [targetUID: 00000000-00009196] "pypocketfft.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\fft\_pocketfft\pypocketfft.pyd]- [targetUID: 00000000-00009196] "_special_ufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_special_ufuncs.pyd]- [targetUID: 00000000-00009196] "_arpack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_eigen\arpack\_arpack.pyd]- [targetUID: 00000000-00009196] "_csparsetools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\_csparsetools.pyd]- [targetUID: 00000000-00009196] "_generator.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_generator.pyd]- [targetUID: 00000000-00009196] "_fblas.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_fblas.pyd]- [targetUID: 00000000-00009196] "_cffi.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\zstandard\_cffi.pyd]- [targetUID: 00000000-00009196] "mtrand.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\mtrand.pyd]- [targetUID: 00000000-00009196] "_traversal.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_traversal.pyd]- [targetUID: 00000000-00009196] "_cpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_cpropack.pyd]- [targetUID: 00000000-00009196] "_zpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_zpropack.pyd]- [targetUID: 00000000-00009196] "_cythonized_array_utils.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_cythonized_array_utils.pyd]- [targetUID: 00000000-00009196] "_spropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_spropack.pyd]- [targetUID: 00000000-00009196] "_dpropack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_propack\_dpropack.pyd]- [targetUID: 00000000-00009196] "_superlu.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\linalg\_dsolve\_superlu.pyd]- [targetUID: 00000000-00009196] "cython_lapack.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\cython_lapack.pyd]- [targetUID: 00000000-00009196] "backend_c.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\zstandard\backend_c.pyd]- [targetUID: 00000000-00009196] "_shortest_path.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_shortest_path.pyd]- [targetUID: 00000000-00009196] "_matfuncs_expm.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_matfuncs_expm.pyd]- [targetUID: 00000000-00009196] "_webp.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_webp.pyd]- [targetUID: 00000000-00009196] "_ni_label.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\ndimage\_ni_label.pyd]- [targetUID: 00000000-00009196] "_sodium.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\nacl\_sodium.pyd]- [targetUID: 00000000-00009196] "_decomp_update.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_decomp_update.pyd]- [targetUID: 00000000-00009196] "_gufuncs.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_gufuncs.pyd]- [targetUID: 00000000-00009196] "_matching.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_matching.pyd]- [targetUID: 00000000-00009196] "_flow.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_flow.pyd]- [targetUID: 00000000-00009196] "_reordering.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_reordering.pyd]- [targetUID: 00000000-00009196] "cython_blas.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\cython_blas.pyd]- [targetUID: 00000000-00009196] "_pocketfft_umath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\fft\_pocketfft_umath.pyd]- [targetUID: 00000000-00009196] "_solve_toeplitz.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_solve_toeplitz.pyd]- [targetUID: 00000000-00009196] "_imagingcms.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingcms.pyd]- [targetUID: 00000000-00009196] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_decimal.pyd]- [targetUID: 00000000-00009196] "_matfuncs_sqrtm_triu.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_matfuncs_sqrtm_triu.pyd]- [targetUID: 00000000-00009196] "_bounded_integers.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_bounded_integers.pyd]- [targetUID: 00000000-00009196] "_decomp_lu_cython.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\linalg\_decomp_lu_cython.pyd]- [targetUID: 00000000-00009196] "_min_spanning_tree.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_min_spanning_tree.pyd]- [targetUID: 00000000-00009196] "_uarray.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\_uarray\_uarray.pyd]- [targetUID: 00000000-00009196] "QtXml.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtXml.pyd]- [targetUID: 00000000-00009196] "win32gui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32gui.pyd]- [targetUID: 00000000-00009196] "_specfun.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_specfun.pyd]- [targetUID: 00000000-00009196] "pyexpat.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pyexpat.pyd]- [targetUID: 00000000-00009196] "_cffi_backend.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_cffi_backend.pyd]- [targetUID: 00000000-00009196] "_tools.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\sparse\csgraph\_tools.pyd]- [targetUID: 00000000-00009196] "_common.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_common.pyd]- [targetUID: 00000000-00009196] "_nd_image.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\ndimage\_nd_image.pyd]- [targetUID: 00000000-00009196] "bit_generator.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\bit_generator.pyd]- [targetUID: 00000000-00009196] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_ssl.pyd]- [targetUID: 00000000-00009196] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_lzma.pyd]- [targetUID: 00000000-00009196] "win32security.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32security.pyd]- [targetUID: 00000000-00009196] "win32api.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32api.pyd]- [targetUID: 00000000-00009196] "_elementtree.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_elementtree.pyd]- [targetUID: 00000000-00009196] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_ctypes.pyd]- [targetUID: 00000000-00009196] "sip.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\sip.pyd]- [targetUID: 00000000-00009196] "md__mypyc.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\charset_normalizer\md__mypyc.pyd]- [targetUID: 00000000-00009196] "QtSvg.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PyQt5\QtSvg.pyd]- [targetUID: 00000000-00009196] "_ellip_harm_2.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_ellip_harm_2.pyd]- [targetUID: 00000000-00009196] "_umath_linalg.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\linalg\_umath_linalg.pyd]- [targetUID: 00000000-00009196] "_pcg64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_pcg64.pyd]- [targetUID: 00000000-00009196] "_mt19937.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_mt19937.pyd]- [targetUID: 00000000-00009196] "_ccallback_c.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\_ccallback_c.pyd]- [targetUID: 00000000-00009196] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_bz2.pyd]- [targetUID: 00000000-00009196] "_philox.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_philox.pyd]- [targetUID: 00000000-00009196] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_socket.pyd]- [targetUID: 00000000-00009196] "win32print.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\win32print.pyd]- [targetUID: 00000000-00009196] "_psutil_windows.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00009196] "_asyncio.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_asyncio.pyd]- [targetUID: 00000000-00009196] "messagestream.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\_lib\messagestream.pyd]- [targetUID: 00000000-00009196] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_hashlib.pyd]- [targetUID: 00000000-00009196] "_multiarray_tests.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\_core\_multiarray_tests.pyd]- [targetUID: 00000000-00009196] "_sfc64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB) for MS Windows 5 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\numpy\random\_sfc64.pyd]- [targetUID: 00000000-00009196] "_overlapped.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_overlapped.pyd]- [targetUID: 00000000-00009196] "_comb.pyd" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 11 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\scipy\special\_comb.pyd]- [targetUID: 00000000-00009196] "_multiprocessing.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_multiprocessing.pyd]- [targetUID: 00000000-00009196] "_queue.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_queue.pyd]- [targetUID: 00000000-00009196] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\select.pyd]- [targetUID: 00000000-00009196] "_uuid.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_uuid.pyd]- [targetUID: 00000000-00009196] "_imagingmath.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingmath.pyd]- [targetUID: 00000000-00009196] "injector.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\pyinjector\injector.pyd]- [targetUID: 00000000-00009196] "_speedups.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\markupsafe\_speedups.pyd]- [targetUID: 00000000-00009196] "_win32sysloader.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\_win32sysloader.pyd]- [targetUID: 00000000-00009196] "_imagingtk.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\PIL\_imagingtk.pyd]- [targetUID: 00000000-00009196] "md.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\onefile_9196_133917799527850553\charset_normalizer\md.pyd]- [targetUID: 00000000-00009196]5b:T6b0,"python310.dll" claimed CRC 4514082 while the actual is CRC 54622651 "qt5quick.dll" claimed CRC 4163612 while the actual is CRC 4514082 "qt5qml.dll" claimed CRC 3644285 while the actual is CRC 4163612 "libcrypto-1_1.dll" claimed CRC 3483025 while the actual is CRC 3644285 "qwindows.dll" claimed CRC 1540718 while the actual is CRC 1996286 "qt5network.dll" claimed CRC 1401600 while the actual is CRC 1540718 "qminimal.dll" claimed CRC 898237 while the actual is CRC 1401600 "qoffscreen.dll" claimed CRC 772281 while the actual is CRC 898237 "qt5multimedia.dll" claimed CRC 780155 while the actual is CRC 772281 "libssl-1_1.dll" claimed CRC 747796 while the actual is CRC 780155 "msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll" claimed CRC 680226 while the actual is CRC 692335 "msvcp140.dll" claimed CRC 621282 while the actual is CRC 680226 "qwebp.dll" claimed CRC 553312 while the actual is CRC 621282 "qwebgl.dll" claimed CRC 499105 while the actual is CRC 553312 "qt5qmlmodels.dll" claimed CRC 476749 while the actual is CRC 499105 "qt5dbus.dll" claimed CRC 458059 while the actual is CRC 476749 "qjpeg.dll" claimed CRC 485308 while the actual is CRC 458059 "qtiff.dll" claimed CRC 392850 while the actual is CRC 485308 "qt5svg.dll" claimed CRC 351992 while the actual is CRC 393042 "qt5printsupport.dll" claimed CRC 338162 while the actual is CRC 351992 "concrt140.dll" claimed CRC 354107 while the actual is CRC 338162 "dsengine.dll" claimed CRC 340424 while the actual is CRC 354107 "qt5xml.dll" claimed CRC 221150 while the actual is CRC 340424 "wmfengine.dll" claimed CRC 208520 while the actual is CRC 221150 "qt5websockets.dll" claimed CRC 210186 while the actual is CRC 2085205c:T600,UnhandledExceptionFilter LoadLibraryExW CreateDirectoryW LockResource GetModuleHandleW FindResourceA GetCommandLineA GetProcAddress CreateFileW FindFirstFileExW GetStartupInfoW IsDebuggerPresent GetModuleFileNameW GetCommandLineW GetTempPathW CreateProcessW GetModuleHandleExW GetFileSizeEx FindNextFileW Sleep WriteFile GetFileAttributesW TerminateProcess GetUserNameW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegDeleteKeyExW OpenProcessToken RegOpenKeyExW RegCloseKey RegCreateKeyExW RegCreateKeyW GetTickCount64 OpenFileMappingW CreateFileA FindFirstFileW DeleteFileW GetFileAttributesExW CreateToolhelp32Snapshot Process32Next CreateFileMappingW GetVersionExW VirtualAlloc OpenProcess GetModuleHandleA CreateFileMappingA GetFileSize MapViewOfFile OutputDebugStringW LoadLibraryW ConnectNamedPipe DeviceIoControl GetSystemInfo Process32First send VirtualProtect LoadLibraryA bind sendto recv accept connect WSAStartup listen recvfrom closesocket socket GetTickCount CheckRemoteDebuggerPresent ShellExecuteW GetCursorPos FindWindowA GetWindowThreadProcessId GetUpdateRect SetSecurityDescriptorDacl DisconnectNamedPipe WSASend WSASocketW WSASendTo CreateFileMoniker CopyFileW LoadLibraryExA GetNativeSystemInfo CreateThread EnumPrintersW OutputDebugStringA GetThreadContext SleepConditionVariableSRW SleepConditionVariableCS GetClipboardData GetTempPathA GetUpdateRgn FindWindowW FindWindowExW LookupAccountNameW SetKernelObjectSecurity5d:T686,"_sparsetools.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_multiarray_umath.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_ufuncs_cxx.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_flapack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_ufuncs.pyd" claims program is from Thu Jan 1 00:00:00 1970 "pypocketfft.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_special_ufuncs.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_arpack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_csparsetools.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_generator.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_fblas.pyd" claims program is from Thu Jan 1 00:00:00 1970 "mtrand.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_traversal.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_cpropack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_zpropack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_cythonized_array_utils.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_spropack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_dpropack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_superlu.pyd" claims program is from Thu Jan 1 00:00:00 1970 "cython_lapack.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_shortest_path.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_matfuncs_expm.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_ni_label.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_decomp_update.pyd" claims program is from Thu Jan 1 00:00:00 1970 "_gufuncs.pyd" claims program is from Thu Jan 1 00:00:00 19705e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3YiIiIju4AAAAAAAAAAAXd2IiIiI7uAAAAAAAAAAAN3diIiIjujgAAAAAAAAAA3Y7Yh3eI6I7gAAAAAAAN3diIiIdHiIiI7gAAAAAADd3YiIiIeIiIiO4AAAAAAADd2IhweIhgeIju7gAAAAAAbdiIcAiIcFiI7u4AAAAAAN3diId4iId4ju4AAAAAAABf2IiIiIiIiIiI4AAAAAAN3diIiIiIiIiIj+AAAAAABd3YiIiIiIiIiO7uAAAAAA3d+IiIiIiIiIju7gAAAAAN3YiIiIiIiIiO7gAAAAAAAA3diIiIiIiIjuAAAAAAAAAN3diIiIiIiO7gAAAAAAAADV3YiIiIiI7gAAAAAAAAAAAADd3///7u4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////////////////////////+AD///AA///wAf//wAB//gAAP/4AAD//AAAP/4AAD/8AAD//gAA//wAAP/8AAB/+QAAf/kAAP/+AAH//gAB//8AB///8A///////////////////////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791174473402,"unified_at":"2026-10-05T04:27:53.402Z","metadata":{"hashes":{"sha256":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf","sha1":"ed094bb401b623fb2f392e8678e9781aadd4d23f","md5":"b589f59c29e79d0ae5a48c497d042bbf","sha512":"44d3966250c8ede39fd78c1684066e5860a129a3655d64abd309e7ea66d8a0c13298884f2778954cc18ced2ea00c22b0c4e001c696e33b601427d8762037e610","ssdeep":"1572864:CRlACZiC8bYN4bkaxvPb7M0jRMqMLUfi:CR+YiXUvujuD","ssdeep_chunks":["1572864:CRlACZi","1572864:RlACZiC","1572864:lACZiC8","1572864:ACZiC8b","1572864:CZiC8bY","1572864:ZiC8bYN","1572864:iC8bYN4","1572864:C8bYN4b","1572864:8bYN4bk","1572864:bYN4bka","1572864:YN4bkax","1572864:N4bkaxv","1572864:4bkaxvP","1572864:bkaxvPb","1572864:kaxvPb7","1572864:axvPb7M","1572864:xvPb7M0","1572864:vPb7M0j","1572864:Pb7M0jR","1572864:b7M0jRM","1572864:7M0jRMq","1572864:M0jRMqM","1572864:0jRMqML","1572864:jRMqMLU","1572864:RMqMLUf","1572864:MqMLUfi","3145728:CRlACZi","3145728:RlACZiC","3145728:lACZiC8","3145728:ACZiC8b","3145728:CZiC8bY","3145728:ZiC8bYN","3145728:iC8bYN4","3145728:C8bYN4b","3145728:8bYN4bk","3145728:bYN4bka","3145728:YN4bkax","3145728:N4bkaxv","3145728:4bkaxvP","3145728:bkaxvPb","3145728:kaxvPb7","3145728:axvPb7M","3145728:xvPb7M0","3145728:vPb7M0j","3145728:Pb7M0jR","3145728:b7M0jRM","3145728:7M0jRMq","3145728:M0jRMqM","3145728:0jRMqML","3145728:jRMqMLU","3145728:RMqMLUf","3145728:MqMLUfi","1572864:CR+YiXU","1572864:R+YiXUv","1572864:+YiXUvu","1572864:YiXUvuj","1572864:iXUvuju","1572864:XUvujuD"],"imphash":"259c038cd4434231e0e24f278026a0ea"},"file_info":{"file_name":"RedFire.BYPASS.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":54586368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1747238432000,"last_seen":1747281103000,"last_multi_scan":1747281103000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":198,"suspicious_count":16,"malicious_count":2,"total":216},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.czuyf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.617641","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Gen_Variant_Lazy_617641","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.617641 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.VAEM-7262","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Worgtop.Win32.513","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","identifiers":[{"type":"suspicious","value":"Tries to open private key files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match – Public-private key pair"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"FindResourceA\" with parameter \"27\" - (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"FindResourceA\" with parameter \"3\" - (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140696194339264'}\" (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140701651034560'}\" (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00009196.00000000.276034.65BB0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"XG-Team.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at DC1D0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"_sobol_direction_numbers.npz\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00009912-00000C2B-3334767394\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n file/memory contains long string with (Indicator: \"GetCursorPos\"; File: \"win32api.pyd\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00009912-00000C2B-3327882106\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00009912-00000C2B-3327881142\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00009196)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"XG-Team.exe\" called \"GetForegroundWindow\" (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"XG-Team.exe\" called \"GetVersionExA\" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"XG-Team.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: libcrypto-1_1.dll]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: qt5network.dll]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: python310.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: qt5network.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: win32security.pyd]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: win32api.pyd]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: _psutil_windows.pyd]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: injector.pyd]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolume\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindVolumeMountPointClose\" (Indicator: \"FindVolumeMountPointClose\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimeAdjustment\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"XG-Team.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"XG-Team.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00009196.00000001.277956.62AE8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimeAdjustment\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00009912-00000C46-4025452434","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"XG-Team.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"XG-Team.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$31","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"CreateProcessW\" with parameter \"C:\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" - (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"XG-Team.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"22975046348,9336,3142,,CreateProcessW,kernel32.dll,\"01:11:57.625\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00009196.00000001.277956.65BB0000.00000004.mdmp, 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegLoadKeyW\" (Indicator: \"RegLoadKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libeay32.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: qwindows.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imaging.pyd)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _psutil_windows.pyd)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00009912-00000C46-4025452434\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00009912-00000C46-4025452434\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LookupPrivilegeNameW\" (Indicator: \"LookupPrivilegeName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00009196.00000000.276034.65BB0000.00000004.mdmp, 00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$36","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"y\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\SdbUpdates\\ManifestedMergeStubSdbs\" in Source: 00000000-00009196.00000001.277956.65BB0000.00000004.mdmp\n 00000000-00009196.00000002.279875.65BB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9912:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:9912:120:WilError_03\"\n \"Local\\SM0:9912:304:WilStaging_02\"\n \"__DDrawExclMode__\"\n \"__DDrawCheckExclMode__\"\n \"SM0:9912:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:10028:304:WilStaging_02\"\n \"Local\\SM0:10028:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"XG-Team.exe\" failed to load missing module \"pythoncom310.dll\" - [base:0; Status:ffffffffc000000d]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$37","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"XG-Team.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5E50000\n \"XG-Team.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E5730000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7690000\n \"XG-Team.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7690000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7690000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020425be6fd7f0000@ntdll.dll\"\n \"220023000000000040425be6fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$39","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$3a","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"$3c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3d","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"$3f","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"$40","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$41","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00009912-00000BC1-3326394692]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00009912-00000C46-4025452434]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00009912-00000C46-4025452434]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00010028-00000BC0-3326467820]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"XG-Team.exe\" (UID: 00000000-00009912) was launched with new environment variables: \"NUITKA_ONEFILE_BINARY=\"C:\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\", USERDNSDOMAIN=\"V6pzHk6ITcwZHD3\", NUITKA_ONEFILE_PARENT=\"9196\"\"\n Process \"XG-Team.exe\" (UID: 00000000-00009912) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00010028) was launched with new environment variables: \"QML2_IMPORT_PATH=\"%TEMP%\\ONEFIL~1\\PyQt5\\qml\"\"\n Process \"cmd.exe\" (UID: 00000000-00010028) was launched with modified environment variables: \"Path\"\n Process \"cmd.exe\" (UID: 00000000-00010028) was launched with missing environment variables: \"NUITKA_ONEFILE_BINARY\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$42","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\user32.dll\" [Source: 00000000-00009912-00000C2A-3336877404]\n Observed system executable string:\"%WINDIR%\\system32\\SHCore.dll\" [Source: 00000000-00009912-00000C2A-3336943629]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00009912-00000C2A-3337169250]\n Observed system executable string:\"%WINDIR%\\system32\\dwrite.dll\" [Source: 00000000-00009912-00000C2A-3337898290]\n Observed system executable string:\"%WINDIR%\\system32\\gdi32.dll\" [Source: 00000000-00009912-00000C2A-3337959062]\n Observed system executable string:\"%WINDIR%\\system32\\d3d9.dll\" [Source: 00000000-00009912-00000C2A-3340164245]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"XG-Team.exe\" with commandline \"C:\\\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d ...\" (UID: 00000000-00009912)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00010028)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"XG-Team.exe\" with commandline \"C:\\\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d ...\" (UID: 00000000-00009912)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00010028)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\onefile_9196_133917799527850553\\XG-Team.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"XG-Team.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" queries basic process information of the \"C:\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" (UID: 9196)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"XG-Team.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\onefile_9196_133917799527850553\\_ssl.pyd\"\n \"XG-Team.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\onefile_9196_133917799527850553\\certifi\\cacert.pem\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\onefile_9196_133917799527850553\\xg-team.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00009912-00000C2B-3327881274\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://numpy.org/devdocs/user/troubleshooting-importerror.html\" - Source: \"00000000-00009196.00000000.276034.65BB0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-1_1.dll\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"_rust.pyd\"\n YARA signature for AES encryption matched on file \"libeay32.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: win32api.pyd]\n Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: _psutil_windows.pyd]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"XG-Team.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010864\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"XG-Team.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"XG-Team.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: qwindows.dll)\n Found GetCursorPos() in an import section (Source: win32gui.pyd)\n Found GetCursorPos() in an import section (Source: win32api.pyd)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"pythoncom310.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"__crtGetTickCount64\" (Indicator: \"GetTickCount\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"?passwordMaskDelay@QStyleHints@@QEBAHXZ\" (Indicator: \"password\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"?passwordMaskCharacter@QStyleHints@@QEBA?AVQChar@@XZ\" (Indicator: \"password\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"?password@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z\" (Indicator: \"password\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"XG-Team.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"win32api.pyd\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"_psutil_windows.pyd\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"injector.pyd\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"XG-Team.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$52","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"LsaRemoveAccountRights\" (Indicator: \"LsaRemoveAccountRights\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00009196.00000001.277956.62AE8000.00000004.mdmp, 00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00009196.00000002.279875.62AC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"XG-Team.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"6995A87D87C5DB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$55","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownW\" (Indicator: \"InitiateSystemShutdown\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"libcrypto-1_1.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"libssl-1_1.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"python3.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$58","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"XG-Team.exe\" (Thread ID: 4244) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" has resource with unusual entropy \"RT_ICON:7.984619648965015\"\n \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" has resource with unusual entropy \"RT_RCDATA:7.999051839557023\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\onefile_9196_133917799527850553\\XG-Team.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00009196)\n \"XG-Team.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00009912)\n \"XG-Team.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00009912)\n \"XG-Team.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"XG-Team.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"5\"}","origin":"API Call","mitre_attack_id":"T1016","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"python310.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-1_1.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"_rust.pyd\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"_sodium.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"python310.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-1_1.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"_rust.pyd\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"_sodium.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in file \"qt5network.dll\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"XG-Team.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"XG-Team.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"XG-Team.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"XG-Team.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"XG-Team.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}\n \"XG-Team.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"XG-Team.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"XG-Team.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}\n \"XG-Team.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"5\"}\n \"XG-Team.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to open private key files (file access)","description":"\"XG-Team.exe\" read a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\onefile_9196_133917799527850553\\certifi\\cacert.pem\"","origin":"API Call","mitre_attack_id":"T1552.004","relevance":3,"id":"api-137","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$5b","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$5d","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\onefile_9196_133917799527850553\\XG-Team.exe\" (Handle: 536)\n \"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\onefile_9196_133917799527850553\\XG-Team.exe\" (Handle: 536)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"XG-Team.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00009912)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":107,"dropped_files_count":0,"extracted_files_count":60,"files_written_count":163,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"682564cb16aa3f83a90f312b","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe","analysis_start_time":"2025-05-15T03:51:45+00:00","indicators_count":{"informative":198,"suspicious":35,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}],"processes":[{"pid":9196,"ppid":0,"name":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe","command_line":"","sha256":"6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf","normalized_path":"C:\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe","uid":"00000000-00009196","icon":"$5e"},{"pid":9912,"ppid":9196,"name":"XG-Team.exe","command_line":"C:\\6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf.exe","sha256":"8885e7526bce95da73cbc84543f8d32abd7b8a2fce8497160fa9d748e56bc8f1","normalized_path":"%TEMP%\\onefile_9196_133917799527850553\\XG-Team.exe","parent_uid":"00000000-00009196","uid":"00000000-00009912"},{"pid":10028,"ppid":9912,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00009912","uid":"00000000-00010028"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","msvcp_win.dll","gdi32full.dll","shlwapi.dll","msvcp140_1.dll","qt5xml.dll","msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll","ntdll.dll","win32u.dll","rpcrt4.dll","qt5core.dll","python3.dll","pdh.dll","security.dll","qgif.dll","samcli.dll","gdi32.dll","version.dll","bcryptprimitives.dll","DWrite.dll","d3d9.dll","directxdatabasehelper.dll","VxSSL64.dll","qt5widgets.dll","kernel.appcore.dll","qwindows.dll","qwbmp.dll","DXCore.dll","shell32.dll","oleaut32.dll","sspicli.dll","user32.dll","ws2_32.dll","sechost.dll","combase.dll","vcruntime140.dll","msvcp140.dll","pythoncom310.dll","dbghelp.dll","windows.storage.dll","userenv.dll","comdlg32.dll","urlmon.dll","libsf_error_state.dll","ntdsapi.dll","logoncli.dll","qicns.dll","python310.dll","qt5gui.dll","IPHLPAPI.DLL","libffi-7.dll","libcrypto-1_1.dll","libssl-1_1.dll","psapi.dll","qtiff.dll","pywintypes310.dll","secur32.dll","msimg32.dll","libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll","qwebp.dll","msctf.dll","DataExchange.dll","qsvgicon.dll","ucrtbase.dll","rsaenh.dll","uxtheme.dll","winmm.dll","crypt32.dll","mswsock.dll","qico.dll","qtga.dll","advapi32.dll","SHCore.dll","apphelp.dll","vcruntime140_1.dll","comctl32.dll","wtsapi32.dll","qsvg.dll","d3d10warp.dll","imm32.dll","ole32.dll","profapi.dll","dxgi.dll","mpr.dll","netapi32.dll","netutils.dll","powrprof.dll","d3d11.dll","fltLib.dll","msvcrt.dll","srvcli.dll","libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll","qjpeg.dll","ResourcePolicyClient.dll","TextInputFramework.dll","WinTypes.dll","cryptbase.dll","dwmapi.dll","qt5svg.dll","bcrypt.dll","twinapi.appcore.dll","cryptsp.dll","iertutil.dll","umpdc.dll","qwindowsvistastyle.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_imaging.pyd","sha256":"433681b1e01606b1730d2a7f7811fab558e4e8c0fa91d403cfd8d7cc1a2b6a09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"_imagingcms.pyd","sha256":"1d9643f7c2c76d0cea41d85ca5371688bc10d54ed1103be21f8569f4254ab460","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"_webp.pyd","sha256":"afc6d7811fe0e0870cdc95f6df31a3b409ab6e3cf6562f87bcbca6dc892bb603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qico.dll","sha256":"1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qjpeg.dll","sha256":"fb4e980cb5fafa8a4cd4239329aed93f7c32ed939c94b61fb2df657f3c6ad158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qtiff.dll","sha256":"825174429ced6b3dab18115dbc6c9da07bf5248c86ec1bd5c0dcaeca93b4c22d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qwebp.dll","sha256":"6e37acd0d357871f92b7fde7206c904c734caa02f94544df646957df8c4987af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qminimal.dll","sha256":"05d1e7364dd2a672df3ca44dd6fd85bed3d3dc239dcfe29bfb464f10b4daa628","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qoffscreen.dll","sha256":"54097626faae718a4bc8e436c85b4ded8f8fb7051b2b9563a29aee4ed5c32b7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qwebgl.dll","sha256":"9c3b2fa2383eeed92bb5810bdcf893ae30fa654a30b453ab2e49a95e1ccf1631","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qwindows.dll","sha256":"3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libcrypto-1_1.dll","sha256":"9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libeay32.dll","sha256":"44dca66a470dcca1bf9e6c1f22b4fe2175c4d9e796884cdd61d8536f013416ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libssl-1_1.dll","sha256":"d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"msvcp140.dll","sha256":"88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll","sha256":"ef1a72b0ba3ae462659c8bcaa232338c0d4ddfc50d6dc07eff83dfa745c449a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll","sha256":"32e6c8100bd62e7a91f50996c2a59692dc796b6f140a2dfa4de313ca43d4c748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"python310.dll","sha256":"14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"pythoncom310.dll","sha256":"c3b33ba6c4f646151aed4172562309d9f44a83858ddfd84b2d894a8b7da72b1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5core.dll","sha256":"5191b3c11f18d749306f6ccd5a3f79e620f24b88a4b8f4b2ee645b1ab447820b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5dbus.dll","sha256":"1aa70b106a10c86946e23caa9fc752dc16e29fbe803bba1f1ab30d1c63ee852a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5gui.dll","sha256":"abe7cf9df462041b7d839f96e9f515d162626e11fb60543741af2a40cc19aa89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5network.dll","sha256":"4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5printsupport.dll","sha256":"783d4f1feb8dc0bc00acb8c094d6c1ab39ac6b5858874e60dd3d45677af4307a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5qml.dll","sha256":"30035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5qmlmodels.dll","sha256":"51e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5quick.dll","sha256":"c81ad3c1111544064b1830c6f1aef3c1fd13b401546ab3b852d697c0f4d854b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5svg.dll","sha256":"7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5widgets.dll","sha256":"89da10958edc34fe9b66eab1ac6a6138f602150cfb4f5dfe49ce64c8562331f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5xml.dll","sha256":"ebdf91f0310ab67a79abd2385fa428205856f81e3a753e6e47c31d5946ddd590","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll","sha256":"13330beba9e5b2d1ca5fb9a6f2b5aaadf8396f4f0dccba480ff6607a741546a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"ssleay32.dll","sha256":"a62510849adecda090f53a132be49daa3acd92b4eacb02d0464f62c06d655af6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"_imagingmath.pyd","sha256":"9485825bbebe0d4861a545a4c38a44571b4772d7fd7b51c2e70298b379931314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"_imagingtk.pyd","sha256":"16eb2a3eb49c7a9625d50d13659a2d328509a2146dc3a4b93f1989883681b1fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"QtCore.pyd","sha256":"d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"QtGui.pyd","sha256":"a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"QtSvg.pyd","sha256":"273c667aaeeb15caab83084fd7f2477b97a1d1e585772f2f2cfbed1b4135be3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"QtWidgets.pyd","sha256":"a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"QtXml.pyd","sha256":"4876f5110e0d202158ce8f03a2763e054b31a489a88ff0ad6f95321cde0d0583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qsvgicon.dll","sha256":"42dde60befcf1d9f96b8366a9988626b97d7d0d829ebea32f756d6ecd9ea99a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qgif.dll","sha256":"36174dd4c5f37c5f065c7a26e0ac65c4c3a41fdc0416882af856a23a5d03bb9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qicns.dll","sha256":"f4a229a082d16f80016f366156a2b951550f1e9df6d4177323bbedd92a429909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qsvg.dll","sha256":"b3498f0a10ac4cb42cf7213db4944a34594ff36c78c50a0f249c9085d1b1ff39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qtga.dll","sha256":"5b641dec81aec1cf7ac0cce9fc067bb642fbd32da138a36e3bdac3bb5b36c37a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qwbmp.dll","sha256":"0f05969fb926a62a338782b32446ea3e28e4bfbffc0dbd25ed303fab3404abac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"dsengine.dll","sha256":"3539aa922fcc946c8af2bdbabf10b0260b9cc14ad62ea331d29766b170d1d3d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qtmedia_audioengine.dll","sha256":"1e8dc7e376664b17a5356e53cfb5bb7cff148e05a5b96923ef59e2c29ada28fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"wmfengine.dll","sha256":"7e76a6b05ea7919a17c90591aa406e4f4835bb6478b5e43fc683c18f251ea96f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qxdgdesktopportal.dll","sha256":"e23fbc1bec6ceedfa9fd305606a460d9cac5d43a66d19c0de36e27632fddd952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"windowsprintersupport.dll","sha256":"c7a1bbf4ea6a74888e71f7199373c9920017199b41f624267ead151eb8cf99b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qwindowsvistastyle.dll","sha256":"d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"XG-Team.exe","sha256":"384f905d28d7486149e2183ae6b2a6f5c8bcc68a3812d7420da534c4c5a372eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"cacert.pem","sha256":"94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"concrt140.dll","sha256":"1f072a6dc98cd882c542208e7a8fe4fbe5239781588f17c005a2607fdfe62d5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"libsf_error_state.dll","sha256":"cf853cb2aa008a5cc814e464e522fafb7e79ff3dab83e596c3cdf089c2ed3eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"msvcp140_1.dll","sha256":"446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"python3.dll","sha256":"dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"pywintypes310.dll","sha256":"c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5multimedia.dll","sha256":"1a59ae2a9ff768ad6bfb888fe3dd2544e238f0b28da83cf375ebd803ce713dc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"qt5websockets.dll","sha256":"6b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}],"files_written":[{"path":"%TEMP%\\onefile_9196_133917799527850553\\XG-Team.exe","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_cffi_backend.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\_win32sysloader.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\concrt140.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\libeay32.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\libsf_error_state.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\msvcp140_1.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\python3.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\python310.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\pythoncom310.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\pywintypes310.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5core.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5dbus.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5gui.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5multimedia.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5network.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5printsupport.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5qml.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5qmlmodels.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5quick.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5svg.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5websockets.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5widgets.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\qt5xml.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\select.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\ssleay32.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\win32api.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\win32gui.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\win32print.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\win32security.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PIL\\_imaging.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PIL\\_imagingcms.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PIL\\_imagingmath.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PIL\\_imagingtk.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PIL\\_webp.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\QtCore.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\QtGui.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\QtSvg.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\QtWidgets.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\QtXml.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\sip.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\Qt\\.keep_dir.txt","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\Qt5\\.keep_dir.txt","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\iconengines","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\iconengines\\qsvgicon.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qgif.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qicns.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qico.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qjpeg.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qsvg.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qtga.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qtiff.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qwbmp.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\imageformats\\qwebp.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\mediaservice\\dsengine.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\mediaservice\\qtmedia_audioengine.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\mediaservice\\wmfengine.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\platforms\\qminimal.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\platforms\\qoffscreen.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\platforms\\qwebgl.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\platforms\\qwindows.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\platformthemes\\qxdgdesktopportal.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\printsupport\\windowsprintersupport.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\PyQt5\\qt-plugins\\styles\\qwindowsvistastyle.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\Resource\\AB.png","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\Resource\\ABLITE.png","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\Resource\\CODM.png","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\Resource\\FF.png","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\Resource\\FFMAX.png","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\charset_normalizer\\md.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\charset_normalizer\\md__mypyc.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\cryptography\\hazmat\\bindings","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\cryptography\\hazmat","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\cryptography\\hazmat\\bindings\\_rust.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\markupsafe\\_speedups.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\nacl\\_sodium.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\_core","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\_core\\_multiarray_tests.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\_core\\_multiarray_umath.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\fft\\_pocketfft_umath.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\linalg\\_umath_linalg.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_bounded_integers.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_common.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_generator.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_mt19937.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_pcg64.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_philox.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\_sfc64.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\bit_generator.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy\\random\\mtrand.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy.libs\\libscipy_openblas64_-c16e4918366c6bc1f1cd71e28ca36fc0.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\numpy.libs\\msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\pyinjector\\injector.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\_lib","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\_lib\\_ccallback_c.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\_lib\\messagestream.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\_lib\\_uarray\\_uarray.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\fft\\_pocketfft","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\fft\\_pocketfft\\pypocketfft.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_cythonized_array_utils.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_decomp_lu_cython.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_decomp_update.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_fblas.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_flapack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_matfuncs_expm.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_matfuncs_sqrtm_triu.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\_solve_toeplitz.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\cython_blas.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\linalg\\cython_lapack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\ndimage\\_nd_image.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\ndimage\\_ni_label.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\_csparsetools.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\_sparsetools.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_flow.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_matching.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_min_spanning_tree.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_reordering.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_shortest_path.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_tools.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\csgraph\\_traversal.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_dsolve","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_dsolve\\_superlu.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_eigen\\arpack","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_eigen\\arpack\\_arpack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_propack\\_cpropack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_propack\\_dpropack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_propack\\_spropack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\sparse\\linalg\\_propack\\_zpropack.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_comb.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_ellip_harm_2.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_gufuncs.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_specfun.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_special_ufuncs.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_ufuncs.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\special\\_ufuncs_cxx.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy\\stats\\_sobol_direction_numbers.npz","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\scipy.libs\\libscipy_openblas-5b1ec8b915dfb81d11cebc0788069d2d.dll","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\zstandard\\_cffi.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\onefile_9196_133917799527850553\\zstandard\\backend_c.pyd","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9912:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Local\\SM0:9912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"SM0:9912:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:10028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]},{"name":"Local\\SM0:10028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682564cb16aa3f83a90f312b"}]}]}},"report_ids":{"sandbox_job_ids":["682564cb16aa3f83a90f312b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Lazy.Generic Sample 6129a08b7656… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6129a08b7656…. Malware family: Lazy.Generic. Threat score 85/100. 7/25 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample 6129a08b7656… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6129a08b7656…. Malware family: Lazy.Generic. Threat score 85/100. 7/25 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6129a08b7656c8d97a445e9b0a84cd6cb612f65f41aa76ad65b4628c539d6adf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample 6129a08b7656… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6129a08b7656…. Malware family: Lazy.Generic. Threat score 85/100. 7/25 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]