24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T447,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 7d4b5dee59d7… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 7d4b5dee59d7…. Threat score 85/100. 0/1 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a"],"about":{"@type":"SoftwareApplication","name":"alpha_silverfox_scanner.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":3,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T115e,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "alpha_silverfox_scanner.exe") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "vkFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp")26:T13c0,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "alpha_silverfox_scanner.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "alpha_silverfox_scanner.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "alpha_silverfox_scanner.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp, 00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp")27:T8f2,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "alpha_silverfox_scanner.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")28:T1075,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp")29:Td61,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp")2a:Tfb4,"alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{767E6811-49CB-4273-87C2-20F355E1085B}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{E25B5812-BE88-4BD9-94B0-29233477B6C3}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{98EC0E18-2098-4D44-8644-66979315A281}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-1271187874-1938232448-3812392235-1001\FDEPLOY") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\WCOSENUMERATIONBASELINEALLOWEDLIST") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PROPERTYBAG") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG")2b:Ta3a,"alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3181110641 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3181117057 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3181375154 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3181381663 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3182204302 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3182210850 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3187862232 [PID: 6556] "alpha_silverfox_scanner.exe" queried SystemProcessInformation at 00000000-00006556-00000C15-3187869187 [PID: 6556] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3188721385 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3188730435 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3189120627 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3189129602 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3189730620 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3189739330 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3190126791 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3190134284 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3191078376 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3191084925 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3200148128 [PID: 5208] "start.exe" queried SystemProcessInformation at 00000000-00005208-00000C15-3200188347 [PID: 5208] "cmd.exe" queried SystemProcessInformation at 00000000-00007816-00000C15-3194860149 [PID: 7816] "cmd.exe" queried SystemProcessInformation at 00000000-00007816-00000C15-3194868898 [PID: 7816] "cmd.exe" queried SystemProcessInformation at 00000000-00007816-00000C15-3195536489 [PID: 7816] "cmd.exe" queried SystemProcessInformation at 00000000-00007816-00000C15-3195548160 [PID: 7816] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00007272-00000C15-3213796563 [PID: 7272]2c:T888,"msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\5b4665ce-8a81-486d-8643-c1dcda08f524.tmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Local State" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Extension Rules\000001.dbtmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Extension Rules\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Site Characteristics Database\000001.dbtmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Site Characteristics Database\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\temp-index" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Sync Data\LevelDB\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\temp-index" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\shared_proto_db\metadata\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\a08eedbb-1502-4353-adef-8e9e44843220.tmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Secure Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\dc35e4f7-c316-43d8-947c-c24d18cbcedb.tmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Network\6b0f9722-d7ca-4c42-9b13-acda19f83a02.tmp" to "%TEMP%\tmpq_jfxzzv\EBWebView\Default\Network\Network Persistent State"2d:T10ce,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003660.00000000.270924.E0A13000.00000004.mdmp")2e:T6aa,"msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "14baecd88cd86197979e9592a3614e57bbd01235" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "14baecd88cd86197979e9592a3614e57bbd01235" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "14baecd88cd86197979e9592a3614e57bbd01235" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "14baecd88cd86197979e9592a3614e57bbd01235" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "14baecd88cd86197979e9592a3614e57bbd01235" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "14baecd88cd86197979e9592a3614e57bbd01235" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcchString": "28000000"}2f:Tc00,"msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cchString": "40" "dwFlags": "8" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cchString": "40" "dwFlags": "8" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AClMRqV/3AE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AClMRqV/3AE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AClMRqV/3AE=" "cchString": "12" "dwFlags": "6" "pbBinary": "00294c46a57fdc01" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" (UID: 00000000-00007272) "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "bNhkXG6e3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "bNhkXG6e3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "bNhkXG6e3QE=" "cchString": "12" "dwFlags": "6" "pbBinary": "6cd8645c6e9edd01" "pcbBinary": "08000000"}30:T5b0,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption31:T13a07,Found XOR loop in file "start.exe" at offset 25324; code bytes = 30d0 Found XOR loop in file "start.exe" at offset 812476; code bytes = 30d0 Found XOR loop in file "start.exe" at offset 1543732; code bytes = 30d0 Found XOR loop in file "start.exe" at offset 1543747; code bytes = 30d0 Found XOR loop in file "start.exe" at offset 2192636; code bytes = 30d0 Found XOR loop in file "start.exe" at offset 310105; code bytes = 33c1 Found XOR loop in file "start.exe" at offset 4163068; code bytes = 33c1 Found XOR loop in file "start.exe" at offset 4494729; code bytes = 33c1 Found XOR loop in file "start.exe" at offset 1726451; code bytes = 8030 Found XOR loop in file "start.exe" at offset 1726458; code bytes = 8030 Found XOR loop in file "start.exe" at offset 1804316; code bytes = 8030 Found XOR loop in file "start.exe" at offset 1804331; code bytes = 8030 Found XOR loop in file "start.exe" at offset 2904421; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5062680; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5062763; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5062846; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5176330; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5176505; code bytes = 8030 Found XOR loop in file "start.exe" at offset 5176555; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2138765; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2972783; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3572723; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3766713; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3862058; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3915921; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3991767; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4030516; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4035859; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4110261; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4363435; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4383919; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4428927; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4439789; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4475761; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4599654; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4610043; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4646386; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4646456; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4674324; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4687275; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 5140064; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 5151068; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 5161540; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 66502; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 109202; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 219491; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 219691; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 219929; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 234369; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 243124; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 243778; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 245653; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 246611; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 354631; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 378144; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 399973; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 402327; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 404103; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 404241; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 443605; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 446813; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 448949; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 529552; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 530841; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 550456; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 677607; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 883850; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 888206; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 889386; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1034959; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035267; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035358; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035381; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035430; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035581; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035841; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1035919; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036004; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036056; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036145; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036203; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036537; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036622; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036723; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036775; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1036825; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037178; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037276; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037366; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037417; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037465; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037748; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037822; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037877; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1037996; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038052; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038110; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038442; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038527; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038631; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038684; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1038737; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039103; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039191; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039268; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039369; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039741; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039826; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039908; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1039960; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040023; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040351; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040440; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040542; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040591; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040644; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1040926; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041019; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041173; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041279; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041630; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041695; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041776; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041856; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1041918; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1042335; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1042441; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1042518; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1054540; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1056957; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1057076; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061334; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061421; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061472; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061535; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061607; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061675; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061804; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1061923; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062036; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062170; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062231; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062293; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062364; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062420; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062478; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062564; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062615; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062688; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062739; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062795; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062846; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1062936; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063050; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063106; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063194; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063321; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063379; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063395; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063453; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063535; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063620; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063702; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063787; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063868; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1063952; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064016; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064090; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064167; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064188; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064256; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064330; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064351; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064417; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064474; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064496; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064564; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064584; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064651; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064715; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064838; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1064966; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065105; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065156; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065219; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065349; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065476; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065554; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065602; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065732; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065859; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1065989; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066116; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066246; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066378; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066429; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066510; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066624; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066680; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066754; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066779; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066845; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066861; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066914; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1066935; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067002; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067074; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067151; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067239; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067307; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067385; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067466; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067553; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067633; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067649; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067715; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067796; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067878; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1067954; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068022; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068093; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068166; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068204; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068290; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068341; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068414; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068465; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068521; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068572; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068665; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068781; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1068918; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069035; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069170; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069297; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069424; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069551; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069670; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069721; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069785; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069923; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1069971; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070042; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070116; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070200; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070221; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070291; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070361; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070381; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070439; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070519; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070540; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070604; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070676; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070754; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070834; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070855; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070917; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1070985; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071060; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071131; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071221; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071275; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071417; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071468; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071541; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071596; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071667; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071783; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071932; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1071990; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072043; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072114; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072168; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072219; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072292; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072343; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072415; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072483; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072539; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072610; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072663; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072721; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072792; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072874; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072938; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1072989; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073146; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073228; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073276; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073343; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073418; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073495; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073551; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073605; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073682; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073747; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073824; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073883; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1073959; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074044; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074126; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074205; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074281; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074302; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074370; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074380; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074604; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074676; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074732; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074800; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074936; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1074987; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075051; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075092; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075180; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075310; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075351; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075434; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075485; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075558; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075609; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075672; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075723; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075812; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075863; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1075936; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076000; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076049; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076101; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076166; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076225; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076287; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076361; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1076432; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1090551; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1090633; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1090768; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1090899; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095205; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095291; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095392; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095440; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095495; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095746; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095830; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1095982; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096086; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096386; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096468; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096572; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096620; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096670; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1096988; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097067; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097165; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097218; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097270; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097586; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097815; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1097871; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098180; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098253; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098322; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098404; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098465; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098771; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098848; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1098946; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099000; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099055; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099354; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099588; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099649; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1099955; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100033; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100137; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100185; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100235; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100550; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100720; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1100786; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1437957; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1437966; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1437974; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1438052; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1438061; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1438069; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1533092; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1553908; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1554158; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1554199; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1554881; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1555106; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1597201; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1599155; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1599313; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1599516; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1786266; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1832575; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1894233; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1937001; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1938255; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1939197; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1982671; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1983306; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1989767; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2069198; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2593114; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2744085; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 3851966; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4023826; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4035181; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 300620; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 335507; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512134; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512216; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512298; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512457; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512536; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512695; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512774; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512856; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1512938; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513020; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513102; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513184; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513266; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513348; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513430; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513512; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513594; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513676; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513838; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1513920; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514002; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514084; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514246; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514328; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514410; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514492; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514574; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514656; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514738; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514820; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514902; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1514984; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1728053; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1728476; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1729088; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1796100; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2421795; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3560335; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3572590; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3579787; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3766512; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3830587; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3906481; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3915788; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4035726; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4110128; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 5146048; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1180; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 10860; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 253092; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 391780; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 1861338; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3135238; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139703; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139751; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139811; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3151768; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166569; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166640; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3574649; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3832325; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4035568; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4572232; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4572252; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4643892; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4643972; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4644004; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4644024; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4966824; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4984824; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5018060; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5022996; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5066556; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5082108; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5107436; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 76497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78006; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203177; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227636; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 240728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 244259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 246267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 249337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 265789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 509088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564361; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564811; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565943; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566099; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566255; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567538; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568681; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 703607; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 704292; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705529; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705715; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705924; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 706777; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 706818; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707350; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707442; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707825; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707867; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767244; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767859; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1020201; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1020273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1023347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089737; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089748; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090788; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090849; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092283; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093016; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093054; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093157; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1229225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330837; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338710; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338721; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338896; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338954; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1345452; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1345519; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352742; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352753; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352815; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352931; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352989; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359816; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359848; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359888; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1363641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365118; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365166; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365206; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365251; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365297; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366151; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366180; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1370155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1370386; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1447909; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449694; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1450574; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1450637; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1477062; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523691; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523724; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523757; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641462; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641564; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864383; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1865601; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872159; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1873439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2143675; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2143911; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144147; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144383; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2145109; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2153231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2153242; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2154339; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2197603; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272332; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272445; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272560; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2296964; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2298942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2311887; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474269; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515148; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515241; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515478; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515572; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515673; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515847; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515923; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516117; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516168; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516287; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516485; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516543; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516720; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516894; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517219; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517412; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517593; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517599; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517772; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517778; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517932; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518124; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518714; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518902; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519312; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519318; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519729; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519919; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520282; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520502; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520743; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520991; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521022; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2569231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2569295; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2583039; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2583135; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2612502; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2614896; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2615103; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2615309; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2617046; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619852; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635380; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635540; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635582; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653639; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653713; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653898; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653924; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654150; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654176; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654466; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654729; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654987; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655234; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655781; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656308; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656568; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656834; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657106; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657379; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657880; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657906; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658139; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658164; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658404; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658747; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658936; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658962; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659201; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659227; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659461; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659487; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659731; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659997; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660614; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662176; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662427; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662452; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662687; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662711; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662938; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663192; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663216; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663440; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663465; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663707; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663993; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664290; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664601; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664694; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664793; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664888; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664970; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665093; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665190; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665323; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665418; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671653; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671786; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671795; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672886; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672954; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673121; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673315; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673401; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673561; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673744; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673830; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673979; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673990; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2674173; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2674259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2676995; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677189; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677257; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677424; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677435; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677618; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677704; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677864; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678047; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678133; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678282; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678476; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678562; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2952692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081745; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082245; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082793; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082892; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083043; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083454; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083539; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083683; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084367; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084740; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084980; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085394; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085481; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085632; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086043; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086281; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086684; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086766; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086919; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087405; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087549; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087964; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088049; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088614; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088700; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088854; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089013; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091889; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094010; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094290; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094665; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094882; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095334; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096513; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097107; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097250; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097626; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097703; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097845; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098230; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098604; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098806; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098887; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099399; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099485; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099828; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3131017; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3240639; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3240671; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3241905; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3248703; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3248735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3250111; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3535363; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3535443; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3569809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3579347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3579459; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3580615; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3580655; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3587953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588119; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3702635; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3808960; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3833996; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 5222334; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 253212; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 307435; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 363114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2030064; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2296709; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4009584; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4187650; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4189057; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4189696; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4764540; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4968072; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4986660; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5015500; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5015508; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5071500; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103617; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103625; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103629; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5217627; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5226917; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 35859; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 35939; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314755; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314867; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316023; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316063; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 509481; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 515853; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516019; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 787902; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 267669; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 783195; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 788320; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 792485; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 794595; code bytes = 8030 Found XOR loop in file "pythoncom313.dll" at offset 561632; code bytes = 30d0 Found XOR loop in file "pythoncom313.dll" at offset 650556; code bytes = 30d0 Found XOR loop in file "pythoncom313.dll" at offset 381837; code bytes = 33c1 Found XOR loop in file "pythoncom313.dll" at offset 381975; code bytes = 33c1 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 187575; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 152459; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 597694; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 599379; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 222450; code bytes = 33c1 Found XOR loop in file "Python.Runtime.dll" at offset 317859; code bytes = 33c1 Found XOR loop in file "Python.Runtime.dll" at offset 43496; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 45582; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 138646; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 156733; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 262140; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 293118; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 17052; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 161618; code bytes = 8030 Found XOR loop in file "pywintypes313.dll" at offset 59905; code bytes = 33c1 Found XOR loop in file "pywintypes313.dll" at offset 60043; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 65470; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 60763; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 65909; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 70031; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 32958; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 34643; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 38723; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 54669; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 378624; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8819; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 70717; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 118047; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 704958; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 63875; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 79226; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 404752; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 422508; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 693520; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 693528; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 700251; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 705397; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 709519; code bytes = 8030 Found XOR loop in file "cares.pyd" at offset 289212; code bytes = 30d0 Found XOR loop in file "cares.pyd" at offset 6199; code bytes = 33c1 Found XOR loop in file "cares.pyd" at offset 235127; code bytes = 33c1 Found XOR loop in file "cares.pyd" at offset 294548; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 233676; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 252152; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 262900; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 136355; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 279998; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 216315; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 275291; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 280437; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 284559; code bytes = 8030 Found XOR loop in file "_corecffi.pyd" at offset 180579; code bytes = 33c1 Found XOR loop in file "_greenlet.pyd" at offset 40719; code bytes = 33c1 Found XOR loop in file "_greenlet.pyd" at offset 215416; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 211948; code bytes = 30d0 Found XOR loop in file "pyexpat.pyd" at offset 32314; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32536; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32563; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32658; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32710; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33051; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33327; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33354; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33449; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 67043; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 211390; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 206683; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 211829; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 215951; code bytes = 8030 Found XOR loop in file "_gevent_cgreenlet.pyd" at offset 134131; code bytes = 33c1 Found XOR loop in file "_gevent_cgreenlet.pyd" at offset 78311; code bytes = 8030 Found XOR loop in file "_gevent_cgreenlet.pyd" at offset 80309; code bytes = 8030 Found XOR loop in file "_gevent_cgreenlet.pyd" at offset 180908; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 9079; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 175038; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 170331; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 175477; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 179598; code bytes = 8030 Found XOR loop in file "_cffi_backend.pyd" at offset 103417; code bytes = 30d0 Found XOR loop in file "_cffi_backend.pyd" at offset 106999; code bytes = 33c1 Found XOR loop in file "_gevent_cqueue.pyd" at offset 121587; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3265; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15558; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15609; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15665; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17432; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54408; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54420; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55360; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55372; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56020; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56031; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56687; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56694; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57600; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57653; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57676; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75411; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89357; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89994; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 152510; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52863; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 147803; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 152949; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 157071; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 32115; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 129982; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 125275; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 130421; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 134543; code bytes = 803032:T4f4,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "_psutil_windows.pyd") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005208-00000C2C-3208518830") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")33:T4ae,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "_psutil_windows.pyd") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005208-00000C2C-3208518830") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")34:T826,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "alpha_silverfox_scanner.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "alpha_silverfox_scanner.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WebView2Loader.dll") file/memory contains long string with (Indicator: "GetCursorPos"; File: "win32api.pyd") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005208-00000C2C-3209160427") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")35:T11f3,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "alpha_silverfox_scanner.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")36:Tb0c,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp")37:Tf39,Found system information discovery API: "ExpandEnvironmentStringsW" in file "alpha_silverfox_scanner.exe" Found system information discovery API: "GetSystemInfo" in file "alpha_silverfox_scanner.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "alpha_silverfox_scanner.exe" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00002196.00000000.270974.FA813000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp"38:Taf8,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "alpha_silverfox_scanner.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "alpha_silverfox_scanner.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "WebBrowserInterop.x64.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "win32api.pyd") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005208-00000C2C-3209069315") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005208-00000C2C-3212840375") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")39:T1e52,"alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000f702080200007c76ef02b0e8977748000000d007f7020000f7026dfc98770000000094fc9877d054010300000000000000000000f7020200000048000000dc01f70200000000090000000000f702400000000000000000000103dc0af7025fa80203d80af7020c76ef02feba947700000000000000004000000020000000000000002476ef02eb1709000000010300000000d82402031f000000c11b0600d8240203162902033600000042120600d8240203162902031b000000b877ef02a877ef028476ef0240f8ef02ee710600162902031b00000070431d7730e09d76060d0700c077ef0203000000ffffffff8376ef029f0007009f00070038f8ef02 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000f702b4dfc002400bf7026cedef02feba9477000000000000000002000000b0ad0103b4dfc00288edef02650999771200000000000000d06c9176f0b97875120000009cedef02ae2e96770200000000000000d06c9176acedef02e16c91760200000000000000d4edef0268207d7702000000000000006c680725709280750000000014eeef02201b8277ffffffff24eeef0258107d773c107d779c6b0725709280759cb97875f0b9787504eeef0200eeef020d0000000d00000050419c757cc8d5750000000040419c7520eeef0298eeef02608d8077f0906150feffffff30eeef02900f7d7750419c7540eeef0206258f757cc8d57550419c754ceeef02 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000009477000045730300000006519477000000004cf6ef0274a2ac74000000000000000000000000000000001b88b37409000000000000003082487374a2ac740000000009000000781d030300000000180000001653ebb07800000000efef027002df0440feef02a01842732a5f47c1feffffff08f6ef025a9b4073b8f5ef020000000000000000739b407334f6ef020000000000000000000000000000000000000000000000000100000000000000010000000000000030f6ef020000000040f6ef020000000034f6ef02000000000000000000000000cbc9e6753e53ebb04cf6ef0203f28f76ed96d38050f6ef026eea8f760000457340f6ef0200000000 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000ef02e0c9ef0200000000dcc9ef02020200007b23718f89a9d3800000b50230df318cb0c9ef02b0e89777114d9df5feffffffc0c9ef02d074010300007e7630fabf73d4479477c547947739a9d3805cd0ef027c8843090da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf7300cdef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef027c88430980fabf730000000028caef027c0b937610aa9f7679a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec02010390c9ef0284cbef0200000103000000000000000000000000000000000000000000000000200000000d001f00d87f430938804309b1ca94773880430900000000280000004200c57304cbef02000000000da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef029ced0a0380fabf73a29490762a000000a0a402030000000079a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003300380031003200330039003100300030003100ef0289a9d380ecc8ef024cc9ef0214deef025c00000026810a03accbef02caff927726810a03a0c9ef025c00000008810a0350ccef02f2ff927700000000000000000da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef029ced0a0380fabf73a294907626000000800103030000000079a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003300380031003200330039003100300030003100ef0289a9d380ecc8ef024cc9ef0214deef025c000000fe7e0a03accbef02caff9277fe7e0a03a0c9ef025c000000e07e0a0350ccef02f2ff927700000000000000000da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef022c090b0380fabf73a294907629000000b8f40a030000000079a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003300380031003200330039003100300030003100ef0289a9d380ecc8ef024cc9ef0214deef025c000000d67c0a03accbef02caff9277d67c0a03a0c9ef025c000000b87c0a0350ccef02f2ff927700000000000000000da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef029ced0a0380fabf73a294907627000000500c0b030000000079a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003300380031003200330039003100300030003100ef0289a9d380ecc8ef024cc9ef0214deef025c00000076850a03accbef02caff927776850a03a0c9ef025c00000058850a0350ccef02f2ff927700000000000000000da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef029ced0a0380fabf73a29490762a00000078f50a030000000079a6c020 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003300380031003200330039003100300030003100ef0289a9d380ecc8ef024cc9ef0214deef025c0000007e8a0a03accbef02caff92777e8a0a03a0c9ef02dfe99477f9abd380001000000810000000000103342c08100da6c020b4c9ef0200cdef02b0acd473fffffffff4c9ef0272fabf73ccc9ef027cceb17372fabf730100000000000000020000007cceb17320caef025cd0ef02dc2c850a80fabf73a294907629000000f8f30a030000000079a6c020 (UID: 00000000-00006556)3a:T468,Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")3b:Ta57,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API ";00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp")3c:T796,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")3d:Ta57,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "alpha_silverfox_scanner.exe") Found reference to API "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API ";00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp")3e:T569,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")3f:T7f3,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")40:Tcad,"start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\qrmkcuan.bitcoin" at 00000000-00005208-00000C17-3191977678 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\hxaiiybs.encrypted" at 00000000-00005208-00000C17-3191979652 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\okmtfnhj.bitcoin" at 00000000-00005208-00000C17-3192049220 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\rpsepagf.bitcoin" at 00000000-00005208-00000C17-3192065122 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\cktykwbk.encrypted" at 00000000-00005208-00000C17-3192075398 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\vmmtzpgr.bitcoin" at 00000000-00005208-00000C17-3192077393 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\tragrvnl.key" at 00000000-00005208-00000C17-3192079279 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\qazukroz.bitcoin" at 00000000-00005208-00000C17-3192081261 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\fbpchopw.bitcoin" at 00000000-00005208-00000C17-3192083322 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\krnmqzjr.bitcoin" at 00000000-00005208-00000C17-3192085213 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\bglcocpc.encrypted" at 00000000-00005208-00000C17-3192087157 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\pcydqshd.key" at 00000000-00005208-00000C17-3192089101 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\umdthjvl.key" at 00000000-00005208-00000C17-3192091244 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\fomlhplj.key" at 00000000-00005208-00000C17-3192095180 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\clyocfve.encrypted" at 00000000-00005208-00000C17-3192097837 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\yxpmbmgu.key" at 00000000-00005208-00000C17-3192099671 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\udulxrer.bitcoin" at 00000000-00005208-00000C17-3192101474 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\cubqhxiv.key" at 00000000-00005208-00000C17-3192103816 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\zxupbqfn.key" at 00000000-00005208-00000C17-3192126754 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\xnkkgmag.encrypted" at 00000000-00005208-00000C17-3192133380 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\zakokilr.bitcoin" at 00000000-00005208-00000C17-3192135871 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\grqjfftt.key" at 00000000-00005208-00000C17-3192139735 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\gqseytfu.encrypted" at 00000000-00005208-00000C17-3192142198 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\auwtclll.key" at 00000000-00005208-00000C17-3192144633 "start.exe" queries volume information of "C:\Users\%OSUSER%\Favorites\yhqasqni.key" at 00000000-00005208-00000C17-319214896241:T71c,"alpha_silverfox_scanner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\START.EXE") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CHROME.EXE") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{25DC2A6F-FDC2-40D0-AA9D-3BF392BDF500}"; Key: "PUBLISHER") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{27B78D8E-F8B9-4AF5-BF9C-8DDD583EAB6B}") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{27B78D8E-F8B9-4AF5-BF9C-8DDD583EAB6B}"; Key: "PUBLISHER") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{43D501A5-E5E3-46EC-8F33-9E15D2A2CBD5}") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{43D501A5-E5E3-46EC-8F33-9E15D2A2CBD5}"; Key: "DISPLAYNAME") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{55BEEF7A-9288-497D-B5CE-960D2F3C70A3}") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-0011-0000-1000-0000000FF1CE}_OFFICE14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}"; Key: "PUBLISHER") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-0044-0409-1000-0000000FF1CE}_OFFICE14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}"; Key: "PUBLISHER") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-006E-0409-1000-0000000FF1CE}_OFFICE14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-006E-0409-1000-0000000FF1CE}_OFFICE14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}"; Key: "PUBLISHER")42:T529,"msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")43:T9fd,"alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter %TEMP%\RarSFX0 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter certifi (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter charset_normalizer (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter clr_loader (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter clr_loader\ffi (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter clr_loader\ffi\dlls (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter clr_loader\ffi\dlls\amd64 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter gevent (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter gevent\libuv (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter gevent\resolver (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter greenlet (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter markupsafe (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter psutil (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter pythonnet (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter pythonnet\runtime (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter templates (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter tornado (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "CreateDirectoryW" with parameter webview (UID: 00000000-00006556)44:T4b3,"start.exe" called "NtCreateNamedPipeFile" with parameter "pipe" - (UID: 00000000-00005208) "start.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5208.2144.11694771121164529144" - (UID: 00000000-00005208) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_7272_ADRBVJPTAWHMHGBI" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7272.668.4638225886037022736" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7272.668.1561993164023096759" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7272.668.12876244869572759315" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7272.668.2753416665859044725" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7272.5156.600244375788013762" - (UID: 00000000-00007272) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_7272_ADRBVJPTAWHMHGBI" - (UID: 00000000-00002792)45:T6b34,"alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXGIDebug.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc_os.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SSPICLI.DLL (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\rsaenh.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTheme.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptbase.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\riched20.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006556) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_bz2.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_lzma.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_uuid.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_socket.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\select.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_ssl.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_wmi.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_hashlib.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\unicodedata.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\markupsafe\_speedups.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_ctypes.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_decimal.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_queue.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\charset_normalizer\md.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\charset_normalizer\md__mypyc.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\_cffi_backend.pyd (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\pythonnet\runtime\Psapi.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Accessibility\54b5bbea0a4dec2a26f0964fd09330d6\Accessibility.ni.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter dwmapi (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\runtimes\win-x64\native\WebView2Loader.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\webview\lib\runtimes\win-x64\native\WebView2Loader.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %TEMP%\RarSFX0\webview\lib\WebView2Loader.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter WebView2Loader.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\EBWebView\x64\EmbeddedBrowserWebView.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\edputil.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00005208) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00005208) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007816) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007816) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedge.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter MDMRegistration.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwrite.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\telclient.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\oneds.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l1-1-0.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter UIAutomationCore.DLL (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TenantRestrictionsPlugin.dll (UID: 00000000-00007272) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002792) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedge.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter mf.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter mfplat.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\hevcdecoder.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DolbyDecMFT.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\D3DCompiler_47.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\libglesv2.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\libegl.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\libGLESv2.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dxgi.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\vulkan-1.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\.\.\vk_swiftshader.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\vk_swiftshader.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter CoreMessaging.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003660) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedge.dll (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002196) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004264) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedge.dll (UID: 00000000-00004264)46:Te03,"msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\BrowserMetrics-spare.pma & %TEMP%\tmpq_jfxzzv\EBWebView\BrowserMetrics\BrowserMetrics-695DF9A9-1C68.pma (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\5b4665ce-8a81-486d-8643-c1dcda08f524.tmp & %TEMP%\tmpq_jfxzzv\EBWebView\Local State (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Extension Rules/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Extension Rules/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Site Characteristics Database/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Site Characteristics Database/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\the-real-index & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\todelete_3d7a05aa9d471010 (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\temp-index & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\js\index-dir\the-real-index (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Sync Data\LevelDB/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Sync Data\LevelDB/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\todelete_147084f1ae21ff17 (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\temp-index & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\shared_proto_db\metadata/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\shared_proto_db\metadata/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\a08eedbb-1502-4353-adef-8e9e44843220.tmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Secure Preferences (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\dc35e4f7-c316-43d8-947c-c24d18cbcedb.tmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Preferences (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\shared_proto_db/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\shared_proto_db/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Extension State/000001.dbtmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Extension State/CURRENT (UID: 00000000-00007272) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Network\6874744b-dc8d-40cc-980d-d0a9599806f0.tmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Network\SCT Auditing Pending Reports (UID: 00000000-00002196) "msedgewebview2.exe" called "MoveFileW" with parameter %TEMP%\tmpq_jfxzzv\EBWebView\Default\Network\6b0f9722-d7ca-4c42-9b13-acda19f83a02.tmp & %TEMP%\tmpq_jfxzzv\EBWebView\Default\Network\Network Persistent State (UID: 00000000-00002196)47:T87b,"SELECT * FROM Win32_OperatingSystem" (Source: alpha_silverfox_scanner.exe, Indicator: "select * from win32_operatingsystem") "INSERT OR REPLACE INTO meta(key,value) VALUES(?,?)" (Source: 00000000-00002196.00000002.274813.0000C000.00000004.mdmp, Indicator: "insert or replace into meta(key,value) values(?,?)"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))l_pair_config_1" (Source: 00000000-00002196.00000002.274813.0000C000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))l_pair_config_1"), "DELETE FROM dictionaries WHERE exp_time<=? RETURNING size token_high token_low" (Source: 00000000-00002196.00000002.274813.00074000.00000004.mdmp, Indicator: "delete from dictionaries where exp_time<=? returning size token_high token_low"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))p" (Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))p"), "CREATE TABLE trust_tokens_toplevel_config ( key TEXT, proto BLOB, PRIMARY KEY(key))W" (Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp, Indicator: "create table trust_tokens_toplevel_config ( key text, proto blob, primary key(key))w"), "CREATE TABLE trust_tokens_issuer_config ( key TEXT, proto BLOB, PRIMARY KEY(key))S" (Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_config ( key text, proto blob, primary key(key))s"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))" (Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))")48:T63a,Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")49:T52f,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")4a:Tcc0,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")4b:T5e5,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "alpha_silverfox_scanner.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "alpha_silverfox_scanner.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")4c:T7cc,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "alpha_silverfox_scanner.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")4d:Tdff,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")4e:Tb1b,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "alpha_silverfox_scanner.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")4f:T6a2,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "alpha_silverfox_scanner.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "alpha_silverfox_scanner.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "GetLastError"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")50:T15e8,"Software\Microsoft\Windows\CurrentVersion" in Source: alpha_silverfox_scanner.exe "Software\WinRAR SFX" in Source: alpha_silverfox_scanner.exe "SOFTWARE\Classes" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp51:T7a7,"alpha_silverfox_scanner.exe" with parameter %TEMP%\RarSFX0 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter C:\Users (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter %USERPROFILE%\AppData (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter certifi (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter charset_normalizer (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter clr_loader (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter clr_loader\ffi (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter clr_loader\ffi\dlls (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter clr_loader\ffi\dlls\amd64 (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter gevent (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter gevent\libuv (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter gevent\resolver (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter greenlet (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter markupsafe (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter psutil (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter pythonnet (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter pythonnet\runtime (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter templates (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter tornado (UID: 00000000-00006556) "alpha_silverfox_scanner.exe" with parameter webview (UID: 00000000-00006556)52:T99d,Process alpha_silverfox_scanner.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6556:64:WilError_03" Process alpha_silverfox_scanner.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6556:168:WilStaging_02" Process alpha_silverfox_scanner.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6556:64:WilError_03" Process alpha_silverfox_scanner.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process alpha_silverfox_scanner.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process alpha_silverfox_scanner.exe created mutex with name "SM0:6556:64:WilError_03" Process alpha_silverfox_scanner.exe created mutex with name "Local\ZonesCacheCounterMutex" Process alpha_silverfox_scanner.exe created mutex with name "Local\SM0:6556:64:WilError_03" Process alpha_silverfox_scanner.exe created mutex with name "Local\SM0:6556:168:WilStaging_02" Process alpha_silverfox_scanner.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5208:304:WilStaging_02" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_03" Process start.exe created mutex with name "Local\SM0:5208:120:WilError_03" Process start.exe created mutex with name "Local\SM0:5208:304:WilStaging_02" Process start.exe created mutex with name "Local\ZonesCacheCounterMutex" Process start.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process start.exe created mutex with name "SM0:5208:120:WilError_03" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5208:120:WilError_03" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7816:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:7816:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7272:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "Local\SM0:7272:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "__OMADM_NAMED_MUTEX__"53:T96c,"alpha_silverfox_scanner.exe" failed to load missing module "%WINDIR%\system32\DXGIDebug.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%TEMP%\RarSFX0\pythonnet\runtime\Psapi.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%TEMP%\RarSFX0\runtimes\win-x64\native\WebView2Loader.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%TEMP%\RarSFX0\webview\lib\WebView2Loader.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "msedgewebview2.exe" failed to load missing module "MDMRegistration.dll" - [base:0; Status:c000000d] "msedgewebview2.exe" failed to load missing module "netapi32.dll" - [base:0; Status:c000000d] "msedgewebview2.exe" failed to load missing module "%WINDIR%\system32\hevcdecoder.dll" - [base:0; Status:c0000135] "msedgewebview2.exe" failed to load missing module "d3d10warp.dll" - [base:0; Status:c000000d]54:Te36,"alpha_silverfox_scanner.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pythoncom313.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Microsoft.Web.WebView2.Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "WebView2Loader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "pywintypes313.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Microsoft.Web.WebView2.WinForms.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ClrLoader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "WebBrowserInterop.x64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "cares.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_corecffi.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_greenlet.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_gevent_cgreenlet.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT55:T53b2,"SOFTWARE\Classes" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "Software\" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "Software\" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\Drivers" in Source: 00000000-00003660.00000001.272844.447F7000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\ImplicitLayers" in Source: 00000000-00003660.00000001.272844.447F7000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\ExplicitLayers" in Source: 00000000-00003660.00000001.272844.447F7000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\LoaderSettings" in Source: 00000000-00003660.00000001.272844.447F7000.00000002.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005208.00000000.268523.D75C0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005208.00000000.268523.D75C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005208.00000000.268523.D84C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000000.268523.D86C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000000.268523.D9710000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005208.00000001.270444.3CB30000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005208.00000001.270444.62C43000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005208.00000001.270444.62C43000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005208.00000001.270444.62C43000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005208.00000001.270444.D75C0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005208.00000001.270444.D75C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005208.00000001.270444.D77C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005208.00000001.270444.D79C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005208.00000001.270444.D84C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000001.270444.D86C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005208.00000001.270444.D8C52000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005208.00000001.270444.D9033000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005208.00000001.270444.D9033000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "y\Machine\Software\Classes\AppID\start.exe" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00005208.00000001.270444.D919D000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000001.270444.D9710000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005208.00000001.270444.D9810000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005208.00000001.270444.D9810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005208.00000001.270444.D9810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005208.00000001.270444.D9F30000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00005208.00000002.272361.48197000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005208.00000002.272361.48197000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00005208.00000002.272361.48197000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005208.00000002.272361.D75C0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005208.00000002.272361.D75C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005208.00000002.272361.D77C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005208.00000002.272361.D79C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005208.00000002.272361.D84C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000002.272361.D86C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4CE576FA-83DC-4F88-951C-9D0782B4E376}" in Source: 00000000-00005208.00000002.272361.D8C52000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005208.00000002.272361.D9033000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005208.00000002.272361.D9033000.00000004.mdmp "NVM_HOME=C:\Users\HAPUBWS\Ap\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00005208.00000002.272361.D919D000.00000004.mdmp "Progra\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}PT=$" in Source: 00000000-00005208.00000002.272361.D919D000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00005208.00000002.272361.D919D000.00000004.mdmp "y\Machine\Software\Classes\AppID\start.exe" in Source: 00000000-00005208.00000002.272361.D919D000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005208.00000002.272361.D9710000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005208.00000002.272361.D9810000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005208.00000002.272361.D9810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005208.00000002.272361.D9810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005208.00000002.272361.D9F30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "Software\" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00007272.00000000.270135.ABAE5000.00000002.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00007272.00000001.272054.0001C000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00007272.00000001.272054.0FC7E000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007272.00000001.272054.0FC7E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000001.272054.0FCA7000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00007272.00000001.272054.0FCA7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00007272.00000001.272054.0FCB9000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000001.272054.0FCB9000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000001.272054.0FCB9000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00007272.00000001.272054.12FD5000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007272.00000001.272054.12FD5000.00000004.mdmp "PSModulePath=C:\Users\HAPUBWS\Documents\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "EFC\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}6eMADX9" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "DataStoreObject":{"Header":{"ObjectType":"Diagnostics" "SchemaVersionMajor":2 "SchemaVersionMinor":1} "ObjectData":{"SystemDefinedProperties":{"entrypoint":{"Type":"InlineString" "IsProtected":false "Value":"GetTokenSilentlyAsync"} "callingApp":{"Type":"InlineString" "IsProtected":false "Value":"C:\\P\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}ng" "IsP" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "DriverData=C:\Windows\System32\D\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "Path=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}\Microso0" in Source: 00000000-00007272.00000002.273976.12F37000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00007272.00000002.273976.12FD5000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007272.00000002.273976.12FD5000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007272.00000002.273976.12FD5000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007272.00000002.273976.3BEA7000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00007272.00000002.273976.3BEA7000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007272.00000002.273976.3BEA7000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007272.00000002.273976.3BEA7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007272.00000002.273976.3C16A000.00000002.mdmp56:T6026,"alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "KERNEL32" at base 77170000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733a0000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 755f0000 "alpha_silverfox_scanner.exe" loaded module "KERNEL32.DLL" at base 77170000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\DXGIDEBUG.DLL" at base 0 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73310000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\SSPICLI.DLL" at base 742f0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 732e0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74e00000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 732b0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 732a0000 "alpha_silverfox_scanner.exe" loaded module "USER32.DLL" at base 76210000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 73220000 "alpha_silverfox_scanner.exe" loaded module "OLE32.DLL" at base 75610000 "alpha_silverfox_scanner.exe" loaded module "COMCTL32.DLL" at base 75380000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 74ac0000 "alpha_silverfox_scanner.exe" loaded module "SHELL32.DLL" at base 75760000 "alpha_silverfox_scanner.exe" loaded module "WINDOWSCODECS.DLL" at base 73450000 "alpha_silverfox_scanner.exe" loaded module "GDI32.DLL" at base 778c0000 "alpha_silverfox_scanner.exe" loaded module "COMCTL32" at base 75380000 "alpha_silverfox_scanner.exe" loaded module "SHLWAPI.DLL" at base 775b0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75760000 "alpha_silverfox_scanner.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73150000 "alpha_silverfox_scanner.exe" loaded module "RPCRT4.DLL" at base 77260000 "alpha_silverfox_scanner.exe" loaded module "ADVAPI32.DLL" at base 76a60000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743b0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73ac0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73950000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 746e0000 "alpha_silverfox_scanner.exe" loaded module "SSPICLI.DLL" at base 742f0000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "VIRTDISK.DLL" at base 74aa0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 739f0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 739f0000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 73880000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 735b0000 "alpha_silverfox_scanner.exe" loaded module "NTDLL.DLL" at base 77900000 "alpha_silverfox_scanner.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d30000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 767e0000 "alpha_silverfox_scanner.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 767e0000 "start.exe" loaded module "KERNEL32" at base 7ffe71be0000 "start.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe70130000 "start.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe70130000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe72850000 "start.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70130000 "start.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70130000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe4ae70000 "start.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe70770000 "start.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffe70130000 "start.exe" loaded module "%TEMP%\RARSFX0\_BZ2.PYD" at base 7ffe53c80000 "start.exe" loaded module "%TEMP%\RARSFX0\_LZMA.PYD" at base 7ffe4e740000 "start.exe" loaded module "%TEMP%\RARSFX0\_UUID.PYD" at base 7ffe56800000 "start.exe" loaded module "RPCRT4.DLL" at base 7ffe72890000 "start.exe" loaded module "%TEMP%\RARSFX0\_SOCKET.PYD" at base 7ffe53180000 "start.exe" loaded module "%TEMP%\RARSFX0\SELECT.PYD" at base 7ffe551c0000 "start.exe" loaded module "%TEMP%\RARSFX0\_SSL.PYD" at base 7ffe4c930000 "start.exe" loaded module "%TEMP%\RARSFX0\_WMI.PYD" at base 7ffe53c70000 "start.exe" loaded module "%TEMP%\RARSFX0\_HASHLIB.PYD" at base 7ffe4c910000 "start.exe" loaded module "%TEMP%\RARSFX0\UNICODEDATA.PYD" at base 7ffe47fd0000 "start.exe" loaded module "%TEMP%\RARSFX0\MARKUPSAFE\_SPEEDUPS.PYD" at base 7ffe524a0000 "start.exe" loaded module "%TEMP%\RARSFX0\_CTYPES.PYD" at base 7ffe4b0a0000 "start.exe" loaded module "%TEMP%\RARSFX0\_DECIMAL.PYD" at base 7ffe4a1c0000 "start.exe" loaded module "SHELL32" at base 7ffe70930000 "start.exe" loaded module "USER32" at base 7ffe72690000 "start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe6ee60000 "start.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe6f2d0000 "start.exe" loaded module "%TEMP%\RARSFX0\_QUEUE.PYD" at base 7ffe4b090000 "start.exe" loaded module "%TEMP%\RARSFX0\CHARSET_NORMALIZER\MD.PYD" at base 7ffe4b080000 "start.exe" loaded module "%TEMP%\RARSFX0\CHARSET_NORMALIZER\MD__MYPYC.PYD" at base 7ffe4af70000 "start.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe672b0000 "start.exe" loaded module "KERNEL32.DLL" at base 7ffe71be0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe67eb0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffe4ade0000 "start.exe" loaded module "OLE32.DLL" at base 7ffe711b0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffe4a110000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffe4a0f0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe6d440000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffe56d60000 "start.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffe49750000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe63410000 "start.exe" loaded module "NTDLL.DLL" at base 7ffe729f0000 "start.exe" loaded module "KERNELBASE" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe622c0000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe70130000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe62390000 "start.exe" loaded module "AMSI.DLL" at base 7ffe62c90000 "start.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe65bb0000 "start.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffe62c10000 "start.exe" loaded module "%WINDIR%\SYSTEM32\4P27IFYZ.DLL" at base 7ffe488a0000 "start.exe" loaded module "%TEMP%\RARSFX0\_CFFI_BACKEND.PYD" at base 7ffe48360000 "start.exe" loaded module "ADVAPI32.DLL" at base 7ffe71970000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe452b0000 "start.exe" loaded module "SHLWAPI.DLL" at base 7ffe72260000 "start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe6ee60000 "start.exe" loaded module "VERSION.DLL" at base 7ffe65bb0000 "start.exe" loaded module "%TEMP%\RARSFX0\CLR_LOADER\FFI\DLLS\AMD64\CLRLOADER.DLL" at base 7ffe68450000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe41610000 "start.exe" loaded module "USER32.DLL" at base 7ffe72690000 "start.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "start.exe" loaded module "MSCOREE.DLL" at base 7ffe46f40000 "start.exe" loaded module "NTDLL" at base 7ffe729f0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 291d5a90000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffe40050000 "start.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe70130000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe44110000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffe3f430000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffe3e9a0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe6edd0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\URLMON.DLL" at base 0 "start.exe" loaded module "URLMON.DLL" at base 7ffe5d810000 "start.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe70130000 "start.exe" loaded module "SSPICLI.DLL" at base 7ffe6f0b0000 "start.exe" loaded module "VIRTDISK.DLL" at base 7ffe48860000 "start.exe" loaded module "%TEMP%\RARSFX0\PYTHONNET\RUNTIME\PSAPI.DLL" at base 0 "start.exe" loaded module "PSAPI.DLL" at base 7ffe72840000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe3e860000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffe3dfb0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffe3ddb0000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffe3ccc0000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\ACCESSIBILITY\54B5BBEA0A4DEC2A26F0964FD09330D6\ACCESSIBILITY.NI.DLL" at base 7ffe489c0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "start.exe" loaded module "UXTHEME.DLL" at base 7ffe6d440000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "start.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 291d5a90000 "start.exe" loaded module "SHELL32.DLL" at base 7ffe70930000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "start.exe" loaded module "BCRYPT.DLL" at base 7ffe6f6f0000 "start.exe" loaded module "COMCTL32.DLL" at base 7ffe56830000 "start.exe" loaded module "GDI32.DLL" at base 7ffe72520000 "start.exe" loaded module "SHCORE" at base 7ffe71430000 "start.exe" loaded module "DWMAPI" at base 7ffe6d850000 "start.exe" loaded module "GDIPLUS.DLL" at base 7ffe422d0000 "start.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffe422d0000 "start.exe" loaded module "%TEMP%\RARSFX0\RUNTIMES\WIN-X64\NATIVE\WEBVIEW2LOADER.DLL" at base 0 "start.exe" loaded module "%TEMP%\RARSFX0\WEBVIEW\LIB\RUNTIMES\WIN-X64\NATIVE\WEBVIEW2LOADER.DLL" at base 7ffe48180000 "start.exe" loaded module "%TEMP%\RARSFX0\WEBVIEW\LIB\WEBVIEW2LOADER.DLL" at base 0 "start.exe" loaded module "WEBVIEW2LOADER.DLL" at base 7ffe48180000 "start.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffe70770000 "start.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffe71430000 "start.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\EBWEBVIEW\X64\EMBEDDEDBROWSERWEBVIEW.DLL" at base 7ffe3c640000 "start.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe69cb0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "start.exe" loaded module "%WINDIR%\SYSTEM32\EDPUTIL.DLL" at base 7ffe55180000 "start.exe" loaded module "COMBASE.DLL" at base 291d5a90000 "start.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 291d5a90000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "start.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffe6d2a0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 7ffe657c0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffe56ae0000 "cmd.exe" loaded module "KERNEL32" at base 7ffe71be0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe70130000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe70130000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe70130000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe72850000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70130000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70130000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70130000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe4ae70000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe6ee60000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe72850000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70130000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70130000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70130000 "msedgewebview2.exe" loaded module "KERNEL32" at base 7ffe71be0000 "msedgewebview2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe4ae70000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffe70770000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe70130000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe70130000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe70130000 "msedgewebview2.exe" loaded module "VERSION.DLL" at base 7ffe65bb0000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffe71430000 "msedgewebview2.exe" loaded module "KERNEL32.DLL" at base 7ffe71be0000 "msedgewebview2.exe" loaded module "ADVAPI32.DLL" at base 7ffe71970000 "msedgewebview2.exe" loaded module "RPCRT4.DLL" at base 7ffe72890000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ffe6ee80000 "msedgewebview2.exe" loaded module "NTMARTA.DLL" at base 7ffe6ee80000 "msedgewebview2.exe" loaded module "USER32.DLL" at base 7ffe72690000 "msedgewebview2.exe" loaded module "NTDLL.DLL" at base 7ffe729f0000 "msedgewebview2.exe" loaded module "KERNELBASE" at base 7ffe70130000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\MSEDGE.DLL" at base 7ffe220a0000 "msedgewebview2.exe" loaded module "KBDUS.DLL" at base 7ffe605d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe6d440000 "msedgewebview2.exe" loaded module "OLE32.DLL" at base 7ffe711b0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe715e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe715e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.PROFILE.PLATFORMDIAGNOSTICSANDUSAGEDATASETTINGS.DLL" at base 7ffe48880000 "msedgewebview2.exe" loaded module "POLICYMANAGER.DLL" at base 7ffe68140000 "msedgewebview2.exe" loaded module "USERENV.DLL" at base 7ffe6f3d0000 "msedgewebview2.exe" loaded module "SHLWAPI.DLL" at base 7ffe72260000 "msedgewebview2.exe" loaded module "MDMREGISTRATION.DLL" at base 0 "msedgewebview2.exe" loaded module "MDMREGISTRATION.DLL" at base 7ffe5a740000 "msedgewebview2.exe" loaded module "NETAPI32.DLL" at base 0 "msedgewebview2.exe" loaded module "NETAPI32.DLL" at base 7ffe651e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ASSIGNEDACCESSRUNTIME.DLL" at base 7ffe4dea0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DWRITE.DLL" at base 7ffe6be50000 "msedgewebview2.exe" loaded module "WS2_32.DLL" at base 7ffe70800000 "msedgewebview2.exe" loaded module "SHELL32.DLL" at base 7ffe70930000 "msedgewebview2.exe" loaded module "COMCTL32.DLL" at base 7ffe56830000 "msedgewebview2.exe" loaded module "CRYPT32.DLL" at base 222150e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffe49750000 "msedgewebview2.exe" loaded module "IPHLPAPI.DLL" at base 7ffe6e940000 "msedgewebview2.exe" loaded module "GDI32.DLL" at base 7ffe72520000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffe722c0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffe711b0000 "msedgewebview2.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ffe71430000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ffe5f250000 "msedgewebview2.exe" loaded module "WTSAPI32.DLL" at base 7ffe690c0000 "msedgewebview2.exe" loaded module "CFGMGR32.DLL" at base 7ffe6fa10000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffe69700000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffe6dcd0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\TELCLIENT.DLL" at base 7ffe3bfb0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\ONEDS.DLL" at base 7ffe3bc70000 "msedgewebview2.exe" loaded module "MSCMS.DLL" at base 7ffe689c0000 "msedgewebview2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe6ee60000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.DIAGNOSTICS.TELEMETRY.PLATFORMTELEMETRYCLIENT.DLL" at base 7ffe46af0000 "msedgewebview2.exe" loaded module "WINHTTP.DLL" at base 7ffe68d70000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.WEB.CORE.DLL" at base 7ffe58840000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\IERTUTIL.DLL" at base 7ffe62720000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe715e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffe5bb20000 "msedgewebview2.exe" loaded module "IMM32.DLL" at base 7ffe72850000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 7ffe70130000 "msedgewebview2.exe" loaded module "SETUPAPI.DLL" at base 7ffe71ce0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe70770000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES" at base 7ffe70770000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 7ffe71430000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ffe5da40000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe6edd0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffe55730000 "msedgewebview2.exe" loaded module "UIAUTOMATIONCORE.DLL" at base 7ffe527f0000 "msedgewebview2.exe" loaded module "OLEACC.DLL" at base 7ffe557b0000 "msedgewebview2.exe" loaded module "OLEAUT32.DLL" at base 7ffe71350000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ffe5cc00000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 7ffe6f600000 "msedgewebview2.exe" loaded module "DEVOBJ.DLL" at base 7ffe6f9e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ffe70130000 "msedgewebview2.exe" loaded module "WINTRUST.DLL" at base 7ffe6fed0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe69cb0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TENANTRESTRICTIONSPLUGIN.DLL" at base 7ffe46210000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ffe4e230000 "msedgewebview2.exe" loaded module "DXGI.DLL" at base 7ffe6d740000 "msedgewebview2.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffe6d8d0000 "msedgewebview2.exe" loaded module "MF.DLL" at base 7ffe4a210000 "msedgewebview2.exe" loaded module "MFPLAT.DLL" at base 7ffe5b3a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\HEVCDECODER.DLL" at base 0 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DOLBYDECMFT.DLL" at base 7ffe44ec0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\D3DCOMPILER_47.DLL" at base 7ffe448d0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\LIBGLESV2.DLL" at base 7ffe356f0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\LIBEGL.DLL" at base 7ffe44850000 "msedgewebview2.exe" loaded module "DWMAPI.DLL" at base 7ffe6d850000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DXGI.DLL" at base 7ffe6d740000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\VULKAN-1.DLL" at base 7ffe44760000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\.\.\VK_SWIFTSHADER.DLL" at base 7ffe35260000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\121.0.2277.106\VK_SWIFTSHADER.DLL" at base 7ffe35260000 "msedgewebview2.exe" loaded module "D3D11.DLL" at base 7ffe6c0c0000 "msedgewebview2.exe" loaded module "D3D10WARP.DLL" at base 0 "msedgewebview2.exe" loaded module "D3D10WARP.DLL" at base 7ffe6a460000 "msedgewebview2.exe" loaded module "COREMESSAGING.DLL" at base 7ffe6cfc0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffe715e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffe725e0000 "msedgewebview2.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffe72690000 "msedgewebview2.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffe72690000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DCOMP.DLL" at base 7ffe6c960000 "msedgewebview2.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffe71970000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe6f2d000057:T1ea7,"alpha_silverfox_scanner.exe" was detected as "WinRAR" and name: "sfx" "alpha_silverfox_scanner.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "alpha_silverfox_scanner.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "alpha_silverfox_scanner.exe" was detected as "Microsoft Linker" and name: "Linker" "alpha_silverfox_scanner.exe" was detected as "RAR" and name: "Archive" "libcrypto-3.dll" was detected as "WinRAR" and name: "sfx" "libcrypto-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "RAR" and name: "Archive" "libssl-3.dll" was detected as "WinRAR" and name: "sfx" "libssl-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "RAR" and name: "Archive" "pythoncom313.dll" was detected as "WinRAR" and name: "sfx" "pythoncom313.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pythoncom313.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pythoncom313.dll" was detected as "Microsoft Linker" and name: "Linker" "pythoncom313.dll" was detected as "RAR" and name: "Archive" "Microsoft.Web.WebView2.Core.dll" was detected as "WinRAR" and name: "sfx" "Microsoft.Web.WebView2.Core.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Microsoft.Web.WebView2.Core.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Microsoft.Web.WebView2.Core.dll" was detected as "Microsoft Linker" and name: "Linker" "Microsoft.Web.WebView2.Core.dll" was detected as "RAR" and name: "Archive" "WebView2Loader.dll" was detected as "WinRAR" and name: "sfx" "WebView2Loader.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WebView2Loader.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WebView2Loader.dll" was detected as "Microsoft Linker" and name: "Linker" "WebView2Loader.dll" was detected as "RAR" and name: "Archive" "pywintypes313.dll" was detected as "WinRAR" and name: "sfx" "pywintypes313.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pywintypes313.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pywintypes313.dll" was detected as "Microsoft Linker" and name: "Linker" "pywintypes313.dll" was detected as "RAR" and name: "Archive" "vcruntime140.dll" was detected as "WinRAR" and name: "sfx" "vcruntime140.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vcruntime140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140.dll" was detected as "RAR" and name: "Archive" "python3.dll" was detected as "WinRAR" and name: "sfx" "python3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "RAR" and name: "Archive" "vcruntime140_1.dll" was detected as "WinRAR" and name: "sfx" "vcruntime140_1.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vcruntime140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140_1.dll" was detected as "RAR" and name: "Archive" "Microsoft.Web.WebView2.WinForms.dll" was detected as "WinRAR" and name: "sfx" "Microsoft.Web.WebView2.WinForms.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Microsoft.Web.WebView2.WinForms.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Microsoft.Web.WebView2.WinForms.dll" was detected as "Microsoft Linker" and name: "Linker" "Microsoft.Web.WebView2.WinForms.dll" was detected as "RAR" and name: "Archive" "ClrLoader.dll" was detected as "WinRAR" and name: "sfx" "ClrLoader.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ClrLoader.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ClrLoader.dll" was detected as "Microsoft Linker" and name: "Linker" "ClrLoader.dll" was detected as "RAR" and name: "Archive" "WebBrowserInterop.x64.dll" was detected as "WinRAR" and name: "sfx" "WebBrowserInterop.x64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WebBrowserInterop.x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WebBrowserInterop.x64.dll" was detected as "Microsoft Linker" and name: "Linker" "WebBrowserInterop.x64.dll" was detected as "RAR" and name: "Archive" "unicodedata.pyd" was detected as "WinRAR" and name: "sfx" "unicodedata.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Linker" and name: "Linker" "unicodedata.pyd" was detected as "RAR" and name: "Archive" "cares.pyd" was detected as "WinRAR" and name: "sfx" "cares.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cares.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cares.pyd" was detected as "Microsoft Linker" and name: "Linker" "cares.pyd" was detected as "RAR" and name: "Archive" "_decimal.pyd" was detected as "WinRAR" and name: "sfx" "_decimal.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "RAR" and name: "Archive" "_corecffi.pyd" was detected as "WinRAR" and name: "sfx" "_corecffi.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_corecffi.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_corecffi.pyd" was detected as "Microsoft Linker" and name: "Linker" "_corecffi.pyd" was detected as "RAR" and name: "Archive" "_greenlet.pyd" was detected as "WinRAR" and name: "sfx" "_greenlet.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_greenlet.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_greenlet.pyd" was detected as "Microsoft Linker" and name: "Linker" "_greenlet.pyd" was detected as "RAR" and name: "Archive" "pyexpat.pyd" was detected as "WinRAR" and name: "sfx" "pyexpat.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pyexpat.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pyexpat.pyd" was detected as "Microsoft Linker" and name: "Linker" "pyexpat.pyd" was detected as "RAR" and name: "Archive" "_gevent_cgreenlet.pyd" was detected as "WinRAR" and name: "sfx" "_gevent_cgreenlet.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_gevent_cgreenlet.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_gevent_cgreenlet.pyd" was detected as "Microsoft Linker" and name: "Linker" "_gevent_cgreenlet.pyd" was detected as "RAR" and name: "Archive" "_ssl.pyd" was detected as "WinRAR" and name: "sfx" "_ssl.pyd" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "RAR" and name: "Archive"58:Tf35,"alpha_silverfox_scanner.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "alpha_silverfox_scanner.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "alpha_silverfox_scanner.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "alpha_silverfox_scanner.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "alpha_silverfox_scanner.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "alpha_silverfox_scanner.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "alpha_silverfox_scanner.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "alpha_silverfox_scanner.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "alpha_silverfox_scanner.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "alpha_silverfox_scanner.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "alpha_silverfox_scanner.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "alpha_silverfox_scanner.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "alpha_silverfox_scanner.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "alpha_silverfox_scanner.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "alpha_silverfox_scanner.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "alpha_silverfox_scanner.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "start.exe" touched "UIHostNoLaunch Class" (Path: "HKCU\CLSID\{4CE576FA-83DC-4F88-951C-9D0782B4E376}\TREATAS") "start.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "start.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "start.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "start.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "start.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "msedgewebview2.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}") "msedgewebview2.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "msedgewebview2.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "msedgewebview2.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "msedgewebview2.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\LOCALSERVER") "msedgewebview2.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS")59:T9d8,Process "start.exe" (UID: 00000000-00005208) was launched with new environment variables: "sfxcmd=""C:\alpha_silverfox_scanner.exe"", USERDNSDOMAIN="DESKTOP-8LD9T6N", sfxname="C:\alpha_silverfox_scanner.exe", sfxstime="2026-01-06-22-13-27-098"" Process "start.exe" (UID: 00000000-00005208) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007816) was launched with new environment variables: "WERKZEUG_SERVER_FD="884"" Process "cmd.exe" (UID: 00000000-00007816) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "cmd.exe" (UID: 00000000-00007816) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedgewebview2.exe" (UID: 00000000-00007272) was launched with new environment variables: "WEBVIEW2_DEFAULT_BACKGROUND_COLOR="ffffffff"" Process "msedgewebview2.exe" (UID: 00000000-00007272) was launched with modified environment variables: "Path" Process "msedgewebview2.exe" (UID: 00000000-00002792) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7272_ADRBVJPTAWHMHGBI", IS_EDGE_WEBVIEW="1", EDGE_WEBVIEW_PREFETCH_HOSTED_APP="/pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74", EDGE_BROWSER_PID="7272"" Process "msedgewebview2.exe" (UID: 00000000-00003660) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\tmpq_jfxzzv\EBWebView", EDGE_USER_DATA_DIR="%TEMP%\tmpq_jfxzzv\EBWebView", EDGE_METRICS_CLIENT_ID_HASH="2219359863310145711"" Process "msedgewebview2.exe" (UID: 00000000-00007752) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, sfxcmd, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, WERKZEUG_SERVER_FD, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, DriverData, IS_EDGE_WEBVIEW, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, EDGE_WEBVIEW_PREFETCH_HOSTED_APP, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, APPDATA, sfxname, CommonProgramFiles, OS, COMPUTERNAME, sfxstime, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, EFC_5568, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH, WEBVIEW2_DEFAULT_BACKGROUND_COLOR"5a:T7ec,"alpha_silverfox_scanner.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "alpha_silverfox_scanner.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "alpha_silverfox_scanner.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "alpha_silverfox_scanner.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "alpha_silverfox_scanner.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME")5b:Tde0,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006556-00000C2B-3181611118] Observed system executable string:"%WINDIR%\system32\DXGIDebug.dll" [Source: 00000000-00006556-00000C2B-3181647250] Observed system executable string:"%WINDIR%\system32\sfc_os.dll" [Source: 00000000-00006556-00000C2B-3181684889] Observed system executable string:"%WINDIR%\system32\SSPICLI.DLL" [Source: 00000000-00006556-00000C2B-3181722629] Observed system executable string:"%WINDIR%\system32\rsaenh.dll" [Source: 00000000-00006556-00000C2B-3181768859] Observed system executable string:"%WINDIR%\system32\UXTheme.dll" [Source: 00000000-00006556-00000C2B-3181807751] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00006556-00000C2B-3181849234] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00006556-00000C2B-3181890833] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00006556-00000C2B-3181999185] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005208-00000C2B-3196503521] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005208-00000C2B-3197388543] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005208-00000C2B-3197731939] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005208-00000C2B-3197945257] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005208-00000C2B-3198270139] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005208-00000C2B-3199367109] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005208-00000C2B-3199467848] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005208-00000C2B-3199527872] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005208-00000C2B-3199803062] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005208-00000C2B-3199889547] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005208-00000C2B-3199950109] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" [Source: 00000000-00005208-00000C2B-3200027510] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005208-00000C2B-3205475733] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005208-00000C2B-3205712430] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005208-00000C2B-3205768052] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00005208-00000C2B-3206066529]5c:T40e,Spawned process "start.exe" (UID: 00000000-00005208) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007816) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=start.exe --user ..." (UID: 00000000-00007272) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\tmpq_jfxzzv\\EBW ..." (UID: 00000000-00002792) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%TEMP%\\tmpq_ ..." (UID: 00000000-00003660), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002196), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004264), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfx ..." (UID: 00000000-00007752)5d:T40e,Spawned process "start.exe" (UID: 00000000-00005208) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007816) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=start.exe --user ..." (UID: 00000000-00007272) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\tmpq_jfxzzv\\EBW ..." (UID: 00000000-00002792) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%TEMP%\\tmpq_ ..." (UID: 00000000-00003660), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002196), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004264), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfx ..." (UID: 00000000-00007752)5e:Tcba,The input sample is signed with a certificate issued by "CN=E7, O=Let's Encrypt, C=US" (SHA1: 77:96:9E:F6:42:EF:97:57:72:DC:E2:2C:04:10:29:15:82:AD:F6:26; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3B:73:C1:7E:3D:F8:7C:F3:AA:77:F1:38:92:19:EB:5E:DD:51:9E:7F; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign ECC OV SSL CA 2018, O=GlobalSign nv-sa, C=BE" (SHA1: D1:C5:B0:F4:00:75:06:AD:09:7C:E2:0F:31:09:74:5C:6D:B4:BF:F0; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign ECC Root CA - R5" (SHA1: 95:3E:42:EE:8D:62:7C:ED:52:B9:6A:DF:C0:22:26:B5:DE:13:04:17; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE" (SHA1: 6B:EA:31:A9:A0:FB:48:98:20:AA:4B:22:D7:77:10:BA:B7:38:AB:1A; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: DF:E8:30:23:06:2B:99:76:82:70:8B:4E:AB:8E:81:9A:FF:5D:97:75; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 0B:BF:AB:97:05:95:95:E8:D1:EC:48:E8:9E:B8:65:7C:0E:5A:AE:71; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 64:5E:B6:A0:28:55:B3:B4:AF:18:7C:AB:E8:27:34:01:AC:F5:B8:49; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C9:FE:FC:76:3D:95:48:B4:87:69:6F:04:7A:CB:A0:AB:E4:5C:7B:C1; see report for more information) The input sample is signed with a certificate issued by "CN=CFCA OV OCA, O=China Financial Certification Authority, C=CN" (SHA1: 73:54:72:06:C3:F8:F1:08:E3:98:23:1A:48:E6:15:B9:D2:7A:AB:0E; see report for more information) The input sample is signed with a certificate issued by "CN=CFCA EV ROOT, O=China Financial Certification Authority, C=CN" (SHA1: 46:B0:AE:C9:33:A6:26:F6:73:BA:FB:74:41:C9:58:69:EA:94:31:46; see report for more information) The input sample is signed with a certificate issued by "CN=CFCA EV ROOT, O=China Financial Certification Authority, C=CN" (SHA1: E2:B8:29:4B:55:84:AB:6B:58:C2:90:46:6C:AC:3F:B8:39:8F:84:83; see report for more information)5f:Tb63,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "alpha_silverfox_scanner.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp")60:T2918,"start.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\start.exe]- [targetUID: 00000000-00005208] "python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\python313.dll]- [targetUID: 00000000-00005208] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libcrypto-3.dll]- [targetUID: 00000000-00005208] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libssl-3.dll]- [targetUID: 00000000-00005208] "pythoncom313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pythoncom313.dll]- [targetUID: 00000000-00006556] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00005208] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00005208] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\RarSFX0\webview\lib\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00005208] "pywintypes313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pywintypes313.dll]- [targetUID: 00000000-00006556] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00005208] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\RarSFX0\python3.dll]- [targetUID: 00000000-00006556] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\vcruntime140_1.dll]- [targetUID: 00000000-00005208] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00005208] "pywebview-android.jar" has type "Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified last modified Sun Jul 28 2025 22:14:40 uncompressed size 0 method=deflate"- Location: [%TEMP%\RarSFX0\webview\lib\pywebview-android.jar]- [targetUID: 00000000-00006556] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%TEMP%\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00005208] "WebBrowserInterop.x64.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\WebBrowserInterop.x64.dll]- [targetUID: 00000000-00006556] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\unicodedata.pyd]- [targetUID: 00000000-00005208] "cares.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\resolver\cares.pyd]- [targetUID: 00000000-00006556] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_decimal.pyd]- [targetUID: 00000000-00005208] "_corecffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\libuv\_corecffi.pyd]- [targetUID: 00000000-00006556] "_greenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\greenlet\_greenlet.pyd]- [targetUID: 00000000-00006556] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\pyexpat.pyd]- [targetUID: 00000000-00006556] "_gevent_cgreenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cgreenlet.pyd]- [targetUID: 00000000-00006556] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ssl.pyd]- [targetUID: 00000000-00005208] "_cffi_backend.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_cffi_backend.pyd]- [targetUID: 00000000-00005208] "_gevent_cqueue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cqueue.pyd]- [targetUID: 00000000-00006556] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_lzma.pyd]- [targetUID: 00000000-00005208] "#U4eba#U6c11#U7f51.html" has type "HTML document Unicode text UTF-8 text with very long lines (859) with CRLF NEL line terminators"- [targetUID: N/A] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_elementtree.pyd]- [targetUID: 00000000-00006556] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\win32api.pyd]- [targetUID: 00000000-00006556] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ctypes.pyd]- [targetUID: 00000000-00005208] "md__mypyc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\charset_normalizer\md__mypyc.pyd]- [targetUID: 00000000-00005208] "_gevent_clocal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_clocal.pyd]- [targetUID: 00000000-00006556] "_gevent_c_hub_primitives.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_hub_primitives.pyd]- [targetUID: 00000000-00006556] "_gevent_c_semaphore.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_semaphore.pyd]- [targetUID: 00000000-00006556] "_gevent_c_abstract_linkable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_abstract_linkable.pyd]- [targetUID: 00000000-00006556] "_gevent_cevent.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cevent.pyd]- [targetUID: 00000000-00006556] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_bz2.pyd]- [targetUID: 00000000-00005208] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_socket.pyd]- [targetUID: 00000000-00005208] "win32evtlog.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\win32evtlog.pyd]- [targetUID: 00000000-00006556] "_gevent_c_imap.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_imap.pyd]- [targetUID: 00000000-00006556] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_asyncio.pyd]- [targetUID: 00000000-00006556] "_gevent_c_waiter.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_waiter.pyd]- [targetUID: 00000000-00006556] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00006556] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_hashlib.pyd]- [targetUID: 00000000-00005208] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_overlapped.pyd]- [targetUID: 00000000-00006556] "_gevent_c_greenlet_primitives.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_greenlet_primitives.pyd]- [targetUID: 00000000-00006556] "_gevent_c_hub_local.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_hub_local.pyd]- [targetUID: 00000000-00006556] "_gevent_c_ident.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_ident.pyd]- [targetUID: 00000000-00006556] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_wmi.pyd]- [targetUID: 00000000-00005208] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_multiprocessing.pyd]- [targetUID: 00000000-00006556] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_queue.pyd]- [targetUID: 00000000-00005208] "_zope_interface_coptimizations.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\zope\interface\_zope_interface_coptimizations.pyd]- [targetUID: 00000000-00006556] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\select.pyd]- [targetUID: 00000000-00005208] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_uuid.pyd]- [targetUID: 00000000-00005208] "_speedups.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\markupsafe\_speedups.pyd]- [targetUID: 00000000-00005208] "speedups.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\tornado\speedups.pyd]- [targetUID: 00000000-00006556] "md.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\charset_normalizer\md.pyd]- [targetUID: 00000000-00005208] "index.html" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\RarSFX0\templates\index.html]- [targetUID: 00000000-00006556]61:T487,"Progman" (Program manager) in Source: 00000000-00002196.00000000.270974.FB460000.00000002.mdmp 00000000-00002196.00000002.274813.FB460000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002196.00000000.270974.FB460000.00000002.mdmp 00000000-00002196.00000002.274813.FB460000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00002792.00000000.270316.1D240000.00000002.mdmp 00000000-00002792.00000001.272235.1D240000.00000002.mdmp 00000000-00002792.00000002.274156.1D240000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002792.00000000.270316.1D240000.00000002.mdmp 00000000-00002792.00000001.272235.1D240000.00000002.mdmp 00000000-00002792.00000002.274156.1D240000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00003660.00000000.270924.E1890000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003660.00000000.270924.E1890000.00000002.mdmp62:Tbf9,"alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "alpha_silverfox_scanner.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")63:Ta61,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\python313.dll]- [targetUID: 00000000-00005208] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libcrypto-3.dll]- [targetUID: 00000000-00005208] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libssl-3.dll]- [targetUID: 00000000-00005208] "pythoncom313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pythoncom313.dll]- [targetUID: 00000000-00006556] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00005208] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00005208] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\RarSFX0\webview\lib\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00005208] "pywintypes313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pywintypes313.dll]- [targetUID: 00000000-00006556] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00005208] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\RarSFX0\python3.dll]- [targetUID: 00000000-00006556] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\vcruntime140_1.dll]- [targetUID: 00000000-00005208] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00005208] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%TEMP%\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00005208] "WebBrowserInterop.x64.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\WebBrowserInterop.x64.dll]- [targetUID: 00000000-00006556]64:T10b6,"alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBADF775-48AA-4BF3-8F8E-EC68D113C98E"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "")65:T53f,"alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.1635_none_9fa79a41e294b962\GdiPlus.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\CRYPTSP.DLL" "alpha_silverfox_scanner.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "alpha_silverfox_scanner.exe" trying to touch file "\Global??\FltMgrMsg" "alpha_silverfox_scanner.exe" trying to touch file "C:\WINDOWS\system32\version.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "alpha_silverfox_scanner.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "alpha_silverfox_scanner.exe" trying to touch file "C:\WINDOWS\system32\DXGIDebug.dll"66:T66d,"alpha_silverfox_scanner.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\WINDOWS\system32\DXGIDebug.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\DXGIDebug.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\libcrypto-3.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\libffi-8.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\libssl-3.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\python3.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\python313.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\pythoncom313.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\pywintypes313.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\start.exe" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\vcruntime140.dll" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll"67:T513,"alpha_silverfox_scanner.exe" trying to access non-existent file "C:\alpha_silverfox_scanner.exe.Local\" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTheme.dll.Config" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_queue.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_socket.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_ssl.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_uuid.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_wmi.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\pyexpat.pyd" "alpha_silverfox_scanner.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\select.pyd"68:Tb1a,Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00002196-00000C2C-3239632332") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00002196-00000C2C-3239632642") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")69:Tf30,Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "alpha_silverfox_scanner.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "alpha_silverfox_scanner.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "vkCreatePipelineCache" (Indicator: "CreatePipe"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "vkCreatePipelineLayout" (Indicator: "CreatePipe"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp") Found reference to API "CreatePipeFromPipeStorage" (Indicator: "CreatePipe"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp")6a:Tef8,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000000.270924.E0A13000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")6b:T679,"127.0.0.1" "2.5.29.37" Potential IP "0.0.0.0" found in string "0.0.0.0-devel" Potential IP "1.3.0.1" found in string "1.3.0.1-motley" "0.0.0.0" "0.0.0.1" Potential IP "1.1.1.1" found in string "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/" Potential IP "127.0.0.1" found in string "http://127.0.0.1:5000" Potential IPs "121.0.0.0" "121.0.0.0" found in string "121.0.0.0 Safari/537.36 Edg/121.0.0.0" Potential IP "1.0.0.0" found in string "1.0.0.0 Safari/" "7.0.0.1" Potential IP "102.54.94.97" found in string "# 102.54.94.97 rhino.acme.com" Potential IP "121.0.0.0" found in string "dg/121.0.0.0" Potential IPs "127.0.0.1" "127.0.0.1" found in string "1/0/_dk_http://127.0.0.1 http://127.0.0.1 https://cdn.bootcdn.net/ajax/libs/bootstrap-icons/1.11.1/font/bootstrap-icons.css" Potential IPs "127.0.0.1" "127.0.0.1" found in string "http://127.0.0.1 http://127.0.0.1 https://cdn.bootcdn.net/ajax/libs/bootstrap-icons/1.11.1/font/bootstrap-icons.css" Potential IPs "127.0.0.1" "127.0.0.1" "127.0.0.1" found in string "1/0/_dk_http://127.0.0.1 http://127.0.0.1 http://127.0.0.1:5000/favicon.ico" Potential IP "102.54.94.97" found in string "# 102.54.94.97 rhino.acme.com # source server" Potential IP "38.25.63.10" found in string "# 38.25.63.10 x.acme.com # x client host" Potential IP "127.0.0.1" found in string "# 127.0.0.1 localhost" Potential IP "1.1.1.1" found in string "Cloudflare (1.1.1.1)" Potential IP "9.9.9.9" found in string "Quad9 (9.9.9.9)" "143.92.35.2" Potential IP "127.0.0.1" found in string "http://127.0.0.1:5000/" "27.0.0.1"6c:T7079,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "~0.tz" Heuristic match: "xb.ga" Heuristic match: "x1.mr" Heuristic match: "i9.bh" Heuristic match: "=o.cv" Heuristic match: "0w.ai" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0ea=j/iamy!x~p9" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "manifest.mflk-.com/com/pywebview/com/pywebview/webviewrequestinterceptor.class;,&{b1" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "local.csrc/gevent/local.pysrc/gevent/_gevent_c_greenlet_primitives.pxdsrc/gevent/_gevent_c_waiter.pxdsrc/gevent/_gevent_cgreenlet.pxdsrc/gevent/_gevent_clocal.pxdcpython/type.pxdsrc/gevent/_gevent_c_ident.pxd__debug__lambdagreenlet._c_apigevent._gevent_clo" Pattern match: "event.csrc/gevent/event.pysrc/gevent/_gevent_c_greenlet_primitives.pxdsrc/gevent/_gevent_c_abstract_linkable.pxdsrc/gevent/_gevent_cevent.pxd__debug___get_linkablegevent._gevent_cevent._get_linkable__init__gevent._gevent_cevent.event.__init__gevent._gevent" Pattern match: "www.memtest86.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "https://cdn.bootcdn.net/ajax/libs/bootstrap/5.3.2/css/bootstrap.min.css" Pattern match: "www.people.com.cn" Pattern match: "www.people.com.cnuser-agent" Heuristic match: "cdn.bootcdn.net" Heuristic match: "cdnjs.cloudflare.com" Heuristic match: "edition.cnn.com" Pattern match: "www.bbc.com" Pattern match: "www.nytimes.com" Pattern match: "www.xinhuanet.com" Heuristic match: "virtualcamera.ax" Heuristic match: "ycwebcamerasource.ax" Heuristic match: "..\..\components\edge_appxpack\pwahelper\handlers\pinning.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\pwahelper.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\pwahelper_host.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\base\internal\throw_delegate.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\internal\win32_waiter.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\mutex.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\base\internal\low_level_alloc.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\types\bad_variant_access.cc" Pattern match: "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff" Heuristic match: "..\..\third_party\perfetto\src\protozero\field.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\scattered_heap_buffer.cc" Heuristic match: "..\..\third_party\perfetto\src\base\thread_task_runner.cc" Heuristic match: "..\..\third_party\perfetto\src\base\unix_task_runner.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\internal\tracing_muxer_fake.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\null_trace_writer.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\virtual_destructors.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\string_table_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\throttle_store.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\watson_metadata.cc" Heuristic match: "mbp?..\..\mojo\core\channel.cc" Heuristic match: "..\..\mojo\core\core.cc" Heuristic match: "..\..\mojo\core\dispatcher.cc" Heuristic match: "..\..\mojo\core\ipcz_driver\mojo_trap.cc" Heuristic match: "..\..\mojo\core\ipcz_driver\transport.cc" Heuristic match: "..\..\mojo\core\node_controller.cc" Heuristic match: "..\..\mojo\core\platform_handle_in_transit.cc" Heuristic match: "..\..\mojo\core\shared_buffer_dispatcher.cc" Heuristic match: "..\..\mojo\core\user_message_impl.cc" Heuristic match: "..\..\mojo\core\broker_win.cc" Heuristic match: "..\..\mojo\core\channel_win.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\web_app_widgets\winrt_widgets_platform.cc" Heuristic match: "..\..\components\edge_shell\pinning_win.cc" Heuristic match: "..\..\base\trace_event\trace_log.cc" Pattern match: "crbug.com/1225176" Heuristic match: "..\..\base\trace_event\process_memory_dump.cc" Heuristic match: "blink.net" Heuristic match: "..\..\base\win\win_util.cc" Heuristic match: "..\..\base\win\registry.cc" Heuristic match: ".a..\..\base\time\time_win.cc" Heuristic match: "..\..\base\threading\platform_thread_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_watcher_win.cc" Heuristic match: "..\..\base\synchronization\condition_variable_win.cc" Heuristic match: "..\..\base\process\launch_win.cc" Heuristic match: "..\..\base\files\file_win.cc" Heuristic match: "..\..\base\files\file_util_win.cc" Heuristic match: "..\..\base\files\file_enumerator_win.cc" Heuristic match: "..\..\base\threading\thread.cc" Heuristic match: "..\..\base\synchronization\waitable_event.cc" Heuristic match: "..\..\base\run_loop.cc" Heuristic match: "..\..\base\metrics\field_trial_params.cc" Heuristic match: "..\..\base\check.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crashpad_client_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\settings.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io.cc" Heuristic match: "..\..\mojo\core\ports\node.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel_server.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel.cc" Heuristic match: "..\..\mojo\public\c\system\thunks.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\validation_errors.cc" Heuristic match: "..\..\mojo\public\cpp\system\invitation.cc" Heuristic match: "..\..\base\system\sys_info_win.cc" Pattern match: "extensions.database.open/0x" Heuristic match: "..\..\base\native_library_win.cc" Heuristic match: "..\..\base\win\message_window.cc" Heuristic match: "..\..\base\win\security_util.cc" Heuristic match: "..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\metrics\statistics_recorder.cc" Heuristic match: "..\..\base\metrics\persistent_memory_allocator.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\critical_section_with_debug_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\directory_reader_win.cc" Heuristic match: "..\..\mojo\public\cpp\platform\named_platform_channel_win.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel_server_win.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\multiplex_router.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\connection_group.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\scoped_interface_endpoint_handle.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\connector.cc" Heuristic match: "..\..\base\win\edge_trace_logging\trace_logging.cc" Heuristic match: "..\..\services\tracing\public\cpp\perfetto\perfetto_traced_process.cc" Heuristic match: "..\..\base\tracing\perfetto_task_runner.cc" Heuristic match: "..\..\third_party\edge_store_service\edge_store_service_platform.cc" Heuristic match: "explicitly_trigg..\..\base\trace_event\trace_logging_minimal_win.cc" Heuristic match: "..\..\base\task\sequence_manager\task_queue_impl.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_task_runner_delegate.cc" Heuristic match: "..\..\base\task\thread_pool\delayed_task_manager.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_single_thread_task_runner_manager.cc" Heuristic match: "..\..\base\task\thread_pool\thread_group.cc" Heuristic match: "..\..\base\task\thread_pool\thread_group_impl.cc" Heuristic match: "..\..\base\task\thread_pool\task_tracker.cc" Heuristic match: "..\..\base\task\thread_pool\sequence.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc" Heuristic match: "..\..\mojo\public\cpp\system\simple_watcher.cc" Heuristic match: "..\..\mojo\public\cpp\system\handle_signal_tracker.cc" Heuristic match: "..\..\services\tracing\public\cpp\perfetto\perfetto_tracing_backend.cc" Heuristic match: "..\..\services\tracing\public\cpp\perfetto\producer_client.cc" Heuristic match: "..\..\services\tracing\public\cpp\perfetto\perfetto_producer.cc" Heuristic match: "..\..\base\allocator\partition_allocator\src\partition_alloc\starscan\stats_collector.cc" Heuristic match: "..\..\mojo\public\cpp\system\data_pipe_drainer.cc" Heuristic match: "..\..\services\tracing\public\cpp\perfetto\custom_event_recorder.cc" Pattern match: "https://watson.telemetry.microsoft.com" Heuristic match: "..\..\chrome\app\chrome_exe_main_win.cc" Heuristic match: "..\..\chrome\app\main_dll_loader_win.cc" Heuristic match: "..\..\chrome\common\win\edge_delay_load_notify_hook.cc" Heuristic match: "..\..\chrome\app\exit_code_watcher_win.cc" Heuristic match: "..\..\chrome\common\default_browser_channel_util_wcos.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\watson_http_uploader.cc" Pattern match: "https://nw-umwatson.events.data.microsoft.com/telemetry.request" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\secondary_data_collectors\file_collector_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\thread_stack_hash_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\watson_uploader\watson_wer_uploader.cc" Heuristic match: "gcc..\..\third_party\crashpad\crashpad\watson_uploader\win\device_ticket.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "..\..\base\time\time_win.cc" Heuristic match: "..\..\base\files\memory_mapped_file_win.cc" Heuristic match: "..\..\base\file_version_info_win.cc" Heuristic match: "..\..\base\path_service.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\edge_minidumpwritedump_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\initial_client_data.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\watson\memory_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\watson\edge_browser_session_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\net\http_transport_win.cc" Heuristic match: "..\..\third_party\zlib\google\zip.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\handler_main.cc" Heuristic match: "..\..\components\gwp_asan\crash_handler\crash_handler.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\process_info.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\arena.cc" Heuristic match: "..\..\base\win\edge_osconsent.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\module_version.cc" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Heuristic match: "..\..\third_party\zlib\google\zip_writer.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\message_lite.cc" Heuristic match: "..\..\base\trace_event\trace_logging_minimal_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\prune_crash_reports.cc" Heuristic match: "@..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\session_end_watcher.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\misc\paths_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc" Heuristic match: "..\..\sandbox\win\src\process_mitigations.cc" Heuristic match: "..\..\sandbox\win\src\sandbox_policy_base.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_seeker.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc" Heuristic match: "utility_sub_type..\..\third_party\crashpad\crashpad\handler\minidump_to_upload_parameters.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\watson_report_upload.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_set_event.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\minidumpwritedump_with_crashpad_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\user_stream_data_source.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory.cc" Heuristic match: "..\..\components\gwp_asan\common\allocator_state.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\memory_snapshot.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writable.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_unloaded_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_handle_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_memory_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_names_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_annotation_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\capture_memory.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_range.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\crashpad_types\crashpad_info_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_string_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_simple_string_dictionary_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_crashpad_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_rva_list_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_annotation_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_byte_array_writer.cc" Heuristic match: "mojom.ne" Pattern match: "https://dnsnl.alekberg.net/dns-query{?dns" Heuristic match: "1cb4af8a.b-anticdn.net" Pattern match: "https://cleanbrowsing.org/privacy" Heuristic match: "adult-filter-dns.cleanbrowsing.org" Pattern match: "https://alekberg.net/privacy" Pattern match: "https://chromium.dns.nextdns.io" Pattern match: "https://nextdns.io/privacy" Pattern match: "https://dns.levonet.sk/dns-query{?dns" Pattern match: "https://public.dns.iij.jp/dns-query" Pattern match: "https://public.dns.iij.jp/" Pattern match: "https://dns.google/dns-query{?dns" Pattern match: "https://doh.dns.sb/dns-query{?dns" Pattern match: "https://www.nic.cz/odvr/" Pattern match: "https://doh.cox.net/dns-query" Pattern match: "https://doh.xfinity.com/dns-query{?dns" Heuristic match: "1dot1dot1dot1.cloudflare-dns.com" Heuristic match: "security-filter-dns.cleanbrowsing.org" Heuristic match: "family-filter-dns.cleanbrowsing.org" Pattern match: "https://dns.quad9.net/dns-query" Pattern match: "https://www.quad9.net/home/privacy/" Pattern match: "https://dns10.quad9.net/dns-query" Pattern match: "https://dns11.quad9.net/dns-query" Pattern match: "https://doh.opendns.com/dns-query{?dns" Pattern match: "yandex.ru/set/s/rsya-tag-users/data" Pattern match: "yandex.ru/portal/set/any" Pattern match: "edge.microsoft.com/componentupdater/api/v1/update?cup2key=6:didj9r-xc6jdla9oqu-dhrdtftymtg88lcflynroesi&cup2hreq=29bb54d4eec8c462424ea7939d7222dbf3c436a02fecbec5379ad8a508add393" Pattern match: "https://dns.sb/privacy/" Pattern match: "https://odvr.nic.cz/doh" Heuristic match: "dflare.com" Heuristic match: "maxpointinteractive.com" Heuristic match: "complexmedianetwork.com" Heuristic match: "directresponsegroup.com" Heuristic match: "conversiondashboard.com" Pattern match: "www.geniegroupltd.co.uk" Heuristic match: "confirmsubscription.com" Heuristic match: "coxdigitalsolutions.com" Heuristic match: "martinimedianetwork.com" Heuristic match: "salesforceliveagent.com" Heuristic match: "channelintelligence.com" Heuristic match: "rakuten-insurance.co.jp" Heuristic match: "quantum-advertising.com" Heuristic match: "webtrackingservices.com" Pattern match: "https://www.cisco.com/c/en/us/about/legal/privacy-full.html" Pattern match: "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/" Heuristic match: "_store.cc" Heuristic match: "as\sqlite\sqlite_persistent_shared_dictionary_store.cc" Heuristic match: "google.ga" Heuristic match: "._uclickwinks.com" Heuristic match: "batanga.com" Heuristic match: "adlibrium.com" Heuristic match: "adfox.ru" Heuristic match: "adyard.de" Heuristic match: "acxiomapac.com" Heuristic match: "adbot.tw" Heuristic match: "sitecompass.com" Heuristic match: "/adshuffle.com" Heuristic match: "theepicmediagroup.com" Heuristic match: "admagnet.com" Heuristic match: "ltremormedia.com" Heuristic match: "campaign-archive1.com" Pattern match: "http://127.0.0.1:5000" Heuristic match: "config.edge.skype.com" Heuristic match: "e.com" Heuristic match: "# 102.54.94.97 rhino.acme.com" Heuristic match: "bootcdn.net" Heuristic match: "*.bootcdn.net" Heuristic match: "otcdn.net" Pattern match: "cdn.bootcdn.net/ajax/libs/bootstrap-icons/1.11.1/font/fonts/bootstrap-icons.woff2?2820a3852bdb9a5832199cc61cec4e65" Pattern match: "http://127.0.0.1" Heuristic match: "jom.pro" Pattern match: "cdn.bootcdn.net/ajax/libs/bootstrap-icons/1.11.1/font/bootstrap-icons.css" Pattern match: "cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css" Pattern match: "www.google.com/" Heuristic match: "bing.com" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Heuristic match: ".b-anticdn.net" Heuristic match: "p.b-anticdn.net" Heuristic match: "ax-msedge.net" Pattern match: "http://wpad/wpad.dat" Pattern match: "https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=6:didj9r-xc6jdla9oqu-dhrdtftymtg88lcflynroesi&cup2hreq=29bb54d4eec8c462424ea7939d7222dbf3c436a02fecbec5379ad8a508add393sarch=x86_64&osver=10.0.22621&wu=1&devicefamily=desktop&uma=0&sessionid" Pattern match: "https://www.bing.com/" Pattern match: "https://edge.microsoft.com/componentupda" Heuristic match: "m231d0b.cdn.b-anticdn.net" Heuristic match: "httpool.com/" Heuristic match: "dns.sb" Heuristic match: "*.config.skype.com" Pattern match: "https://ecs.nel.measure.office.net/api/report?tenantid=edge&destinationendpoint=edge-prod-lax31r5b&frontend=afd}],include_subdomains:true" Heuristic match: "config-edge-skype.ln-0007.ln-msedge.net" Heuristic match: "config.edge.skype.com.trafficmanager.net" Heuristic match: "ln-0007.config.skype.com" Heuristic match: "ln-0007.ln-msedge.net" Pattern match: "http://127.0.0.1:5000/" Pattern match: "https://ecs.nel.measure.office.net/api/report?tenantid=edge&destinationendpoint=edge-prod-lax31r5b&frontend=afd}],include_subdomains:true}nel{report_to:nelecsupload1,max_age:604800,include_subdomains:true,failure_fraction:1.0,success_fraction" Pattern match: "config.edge.skype.com/config/v1/edge/121.0.2277.106?clientid=2219359863310145711&agents=edgeruntimeconfig%2cedgedomainactions&osname=win&client=webview&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.22621&wu=1&devicefamily=desktop&uma=0&sessionid=0&mngd=" Heuristic match: ".com/cohttps" Heuristic match: "n.net" Heuristic match: "ectionconfig.edge.skype.com" Heuristic match: "bootcdn.bootcdn.net" Heuristic match: "277.cdn.bootcdn.net" Pattern match: "https://issuetracker.google.com/292282210" Pattern match: "https://issuetracker.google.com/292285899" Pattern match: "https://issuetracker.google.com/220069903" Pattern match: "https://issuetracker.google.com/258207403" Pattern match: "https://issuetracker.google.com/309028728" Pattern match: "https://issuetracker.google.com/issues/166475273" Pattern match: "https://issuetracker.google.com/255411748" Pattern match: "https://issuetracker.google.com/253522366" Pattern match: "https://issuetracker.google.com/161903006" Pattern match: "https://issuetracker.google.com/184850002" Pattern match: "https://issuetracker.google.com/229267970" Pattern match: "https://issuetracker.google.com/274859104" Pattern match: "https://issuetracker.google.com/250706693" Pattern match: "https://issuetracker.google.com/187425444" Pattern match: "https://issuetracker.google.com/288119108" Pattern match: "https://issuetracker.google.com/166809097" Pattern match: "http://issuetracker.google.com/200067929" Pattern match: "https://issuetracker.google.com/284462263" Pattern match: "http://anglebug.com/8280" Pattern match: "http://anglebug.com/5750" Pattern match: "http://anglebug.com/8417" Pattern match: "http://anglebug.com/5007" Pattern match: "http://anglebug.com/7760" Pattern match: "http://anglebug.com/7279" Pattern match: "http://anglebug.com/6041" Pattern match: "http://anglebug.com/4384" Pattern match: "http://anglebug.com/7724" Pattern match: "http://anglebug.com/4551" Pattern match: "https://anglebug.com/7246" Pattern match: "http://anglebug.com/5658" Pattern match: "http://anglebug.com/8297" Pattern match: "http://anglebug.com/7761" Pattern match: "http://anglebug.com/7036" Pattern match: "http://anglebug.com/1423136" Pattern match: "https://anglebug.com/8417" Pattern match: "http://anglebug.com/3498" Pattern match: "http://anglebug.com/2970" Pattern match: "http://anglebug.com/3970" Pattern match: "http://anglebug.com/4324" Pattern match: "http://anglebug.com/8291" Pattern match: "http://anglebug.com/3205" Pattern match: "http://anglebug.com/5535" Pattern match: "http://anglebug.com/6755" Pattern match: "http://anglebug.com/3586" Pattern match: "https://anglebug.com/7319" Pattern match: "http://anglebug.com/7370" Pattern match: "http://anglebug.com/3502" Pattern match: "http://anglebug.com/8229" Pattern match: "http://anglebug.com/4937" Pattern match: "http://anglebug.com/4722" Pattern match: "http://anglebug.com/4901" Pattern match: "http://anglebug.com/8215" Pattern match: "https://anglebug.com/8300" Pattern match: "http://anglebug.com/3452" Pattern match: "http://anglebug.com/5375" Pattern match: "http://anglebug.com/6876" Pattern match: "http://anglebug.com/3078" Pattern match: "https://anglebug.com/7308" Pattern match: "https://anglebug.com/7369" Pattern match: "http://anglebug.com/8162" Pattern match: "http://anglebug.com/6929" Pattern match: "http://anglebug.com/7406" Pattern match: "http://anglebug.com/7047" Pattern match: "http://anglebug.com/4633" Pattern match: "http://anglebug.com/2162" Pattern match: "http://anglebug.com/4428" Pattern match: "http://anglebug.com/6651" Pattern match: "https://anglebug.com/6574" Pattern match: "http://anglebug.com/6953" Pattern match: "http://anglebug.com/5901" Pattern match: "http://anglebug.com/6860" Pattern match: "https://anglebug.com/7382" Pattern match: "http://anglebug.com/5421" Pattern match: "http://anglebug.com/3577" Pattern match: "https://anglebug.com/7161" Pattern match: "https://anglebug.com/4966" Pattern match: "http://anglebug.com/2517" Pattern match: "http://anglebug.com/6248" Pattern match: "http://anglebug.com/5906" Pattern match: "http://anglebug.com/4836" Pattern match: "http://anglebug.com/5281" Pattern match: "http://anglebug.com/3584" Pattern match: "https://anglebug.com/7320" Pattern match: "http://anglebug.com/6692" Pattern match: "https://anglebug.com/4830" Pattern match: "http://anglebug.com/3206" Pattern match: "http://anglebug.com/7172" Pattern match: "http://anglebug.com/5881" Pattern match: "http://anglebug.com/6048" Pattern match: "http://anglebug.com/6439" Pattern match: "https://anglebug.com/7899" Pattern match: "http://anglebug.com/3862" Pattern match: "http://anglebug.com/4405" Pattern match: "http://anglebug.com/7553" Pattern match: "https://anglebug.com/7604" Pattern match: "http://anglebug.com/3965" Pattern match: "http://anglebug.com/5430" Pattern match: "http://anglebug.com/3832" Pattern match: "https://anglebug.com/5845" Pattern match: "https://anglebug.com/7714" Pattern match: "https://anglebug.com/7847" Pattern match: "http://anglebug.com/5055" Pattern match: "http://anglebug.com/5371" Pattern match: "http://anglebug.com/6878" Pattern match: "https://anglebug.com/7162" Pattern match: "https://anglebug.com/7489" Pattern match: "http://anglebug.com/7556" Pattern match: "http://anglebug.com/6141" Pattern match: "http://anglebug.com/5061" Pattern match: "http://anglebug.com/7488" Pattern match: "http://anglebug.com/3623" Pattern match: "http://b/239181279" Heuristic match: ".data.rel.ro" Heuristic match: "l,)t.ps" Heuristic match: "" (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "FrodoKEM-640-AES" (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "FrodoKEM-976-AES" (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "FrodoKEM-1344-AES" (Indicator: "aes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "SymGetModuleBase64 FAILED" (Indicator: "base64"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "FrodoKEM-640-AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "FrodoKEM-976-AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "FrodoKEM-1344-AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "SymGetModuleBase64 FAILED" (Indicator: "base64"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "ravaESABTDBCCLBC FFC2FFCpamcRLOCLAPCravc tvcGISDTDBECLBECSBEmgpfravfpsagFEDGfylgSOPGBUSGravgxmdhdaehaehhxtmhRAVHFTSJnrekacolHSTLHTAMpxamGREMatemRAVMTLCPtsopperpxibsTATS GVSXMDVaehvxtmvGROVRAVVeman2/SO" (Indicator: "aes"; Source: "00000000-00003660.00000001.272844.31967000.00000004.mdmp")73:T81d,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "alpha_silverfox_scanner.exe") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")74:T1243,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")75:T8be,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")76:T13bf,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")77:T841,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")78:T115b,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "alpha_silverfox_scanner.exe") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")79:T468,Found string "passwords" (Indicator: "password"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "passwords/manual_filling_controller/0x?" (Indicator: "password"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "passwords/manual_filling_controller/0x?" (Indicator: "password"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")7a:T873,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "alpha_silverfox_scanner.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "win32api.pyd") file/memory contains long string with (Indicator: "OpenProcess"; File: "_psutil_windows.pyd") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00005208-00000C2C-3200736069") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005208-00000C2C-3200736576") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00005208-00000C2C-3200736614") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp")7b:T1ad8,Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00005208-00000BC0-3193977122") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00007816-00000BC0-3194150646") Found string "\Device\DeviceApi\CMApi" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "\Device\DeviceApi" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "\Device\" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "\Device\HarddiskVolume" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002196.00000000.270974.FA800000.00000004.mdmp, 00000000-00002196.00000000.270974.FA813000.00000004.mdmp, 00000000-00002196.00000000.270974.FCA00000.00000004.mdmp, 00000000-00002196.00000001.272894.FA800000.00000004.mdmp, 00000000-00002196.00000001.272894.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.000A0000.00000004.mdmp, 00000000-00002196.00000002.274813.FA800000.00000004.mdmp, 00000000-00002196.00000002.274813.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.FCA00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002196.00000000.270974.FA800000.00000004.mdmp, 00000000-00002196.00000000.270974.FA813000.00000004.mdmp, 00000000-00002196.00000000.270974.FCA00000.00000004.mdmp, 00000000-00002196.00000001.272894.FA800000.00000004.mdmp, 00000000-00002196.00000001.272894.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.000A0000.00000004.mdmp, 00000000-00002196.00000002.274813.FA800000.00000004.mdmp, 00000000-00002196.00000002.274813.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.FCA00000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedge_elf.dll" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.270974.FA800000.00000004.mdmp, 00000000-00002196.00000001.272894.FA800000.00000004.mdmp, 00000000-00002196.00000002.274813.FA800000.00000004.mdmp") Found string "i.DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp, 00000000-00002196.00000001.272894.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.FA813000.00000004.mdmp") Found string "i.DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002196.00000000.270974.FA813000.00000004.mdmp, 00000000-00002196.00000001.272894.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.FA813000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00002196.00000002.274813.00060000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00002196.00000002.274813.00060000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00002196.00000002.274813.00074000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00002196.00000002.274813.00074000.00000004.mdmp") Found string "\device\afd\endpoint" (Indicator: "\Device\"; Source: "00000000-00002196.00000002.274813.FA813000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002792.00000000.270316.0030C000.00000004.mdmp, 00000000-00002792.00000000.270316.1C800000.00000004.mdmp, 00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000000.270316.1E800000.00000004.mdmp, 00000000-00002792.00000001.272235.1C800000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002792.00000000.270316.0030C000.00000004.mdmp, 00000000-00002792.00000000.270316.1C800000.00000004.mdmp, 00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000000.270316.1E800000.00000004.mdmp, 00000000-00002792.00000001.272235.1C800000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Indicator: "\Device\"; Source: "00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "i.DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "i.DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002792.00000000.270316.1C813000.00000004.mdmp, 00000000-00002792.00000001.272235.1C813000.00000004.mdmp") Found string "\Device\DeviceApi\CMApi" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "\Device\DeviceApi" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "\Device\" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "\Device\HarddiskVolume" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.270924.E0A13000.00000004.mdmp, 00000000-00003660.00000000.270924.E1300000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.270924.E0A13000.00000004.mdmp, 00000000-00003660.00000000.270924.E1300000.00000004.mdmp") Found string "..\..\third_party\swiftshader\src\Device\Blitter.cpp" (Indicator: "\Device\"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp") Found string "..\..\third_party\swiftshader\src\Device\Context.cpp" (Indicator: "\Device\"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp") Found string "=..\..\third_party\swiftshader\src\Device\Renderer.cpp" (Indicator: "\Device\"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp") Found string "..\..\third_party\swiftshader\src\Device\Sampler.hpp" (Indicator: "\Device\"; Source: "00000000-00003660.00000001.272844.355D0000.00000002.mdmp")7c:Tbd0,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "alpha_silverfox_scanner.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "alpha_silverfox_scanner.exe") Found reference to API "DeleteFileWithDispositionFlags" (Indicator: "DeleteFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "DeleteFileWithDispositionFlags" (Indicator: "DeleteFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")7d:T4f9,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "alpha_silverfox_scanner.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "alpha_silverfox_scanner.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "alpha_silverfox_scanner.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp")7e:T583,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "alpha_silverfox_scanner.exe") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")7f:T1010,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicyInternal" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicyInternal" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp")80:T1292,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "alpha_silverfox_scanner.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "alpha_silverfox_scanner.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "alpha_silverfox_scanner.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "alpha_silverfox_scanner.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "alpha_silverfox_scanner.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "alpha_silverfox_scanner.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "alpha_silverfox_scanner.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "alpha_silverfox_scanner.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "alpha_silverfox_scanner.exe") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CheckTokenCapability" (Indicator: "CheckTokenCapability"; Source: "00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp")81:T937,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "alpha_silverfox_scanner.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp")82:T95c,"alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "alpha_silverfox_scanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\RARSFX0\START.EXE"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "")83:T1cbf,"alpha_silverfox_scanner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "alpha_silverfox_scanner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "alpha_silverfox_scanner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "alpha_silverfox_scanner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "start.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A2729FC39C7FDC010000000000000000000000000200000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "FAILED_COUNT"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0200000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "DR"; Value: "3100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\STABILITYMETRICS"; Key: "USER_EXPERIENCE_METRICS.STABILITY.EXITED_CLEANLY"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW"; Key: "USAGESTATSINSAMPLE"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.CDM.ORIGIN_DATA"; Value: "81046E921B34925EF9312C9A62CC5AFFB0D63E7CA2C13AC486278B291F7C08F2") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.STORAGE_ID_SALT"; Value: "18C0B52B135CAAFE1A26692ACA1C9982741B19572B524EDC4374A776E1410749") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.ACCOUNT_ID"; Value: "FD5FDCB0CAABEDAB8ADBFB8CAE49EFEB86D67C19905F86EA40BE155EA4CF95C3") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.LAST_USERNAME"; Value: "F1D14C0303D45F3F1897EDC54641E381DCFCC0F4DA8AB5729CB2BD090C7E5D29") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "DEFAULT_SEARCH_PROVIDER_DATA.TEMPLATE_URL_DATA"; Value: "8BAF22244C810B6D25BE595D1F42EC353FF7C8FBD9C37513B47A2FFA8AF4E0E3") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SAFEBROWSING.INCIDENTS_SENT"; Value: "EA671475338AD6FE402471D7D8D4EF1281F73757AA24A90655F4D914CBE849AC") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PINNED_TABS"; Value: "B2BF049BBA813039124A63BB29E947E9C847BE52658FFCA0481EC03DBAD455C4") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SEARCH_PROVIDER_OVERRIDES"; Value: "05F935AA9AD5A85C92799FF621F7A2A3F3AFB85EE0BCC32E215F5BB74CDE2DAA") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.LAST_ACCOUNT_ID"; Value: "BF797A435F62001800FC624D2446D7347739FE350D0D9C962EEB7146DFC53F32") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.STARTUP_URLS"; Value: "24745F213395D77E2CAF29CDF5FFD8E20FB835E8842E67462CBEFD3BE1BE8914") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.RESTORE_ON_STARTUP"; Value: "0C2485E85D9BD72F0A0CCF33FF52FF3E53A61AE2C7EEEE5A836EFF40285E79ED") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PREFS.PREFERENCE_RESET_TIME"; Value: "D1453E7B6E0C205D73D8D87653914AE80D4D581F6C41F1B183F4EF42C70BDAA7") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "BROWSER.SHOW_HOME_BUTTON"; Value: "47B54312B5CB65CE9F9BAB1285F556066FC209F95976E493E414072167406768") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE"; Value: "6224108CC3CA531C5AB214984B64A07566F31FED35B7EA78AF79506FE24C70D9") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE_IS_NEWTABPAGE"; Value: "3E57B3E255EA4EEEF742240A3B2D03B8E9FB8F118D889079A164E0EA23345F59") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "LASTRUN"; Value: "13412240049765269") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "VERSION"; Value: "121.0.2277.106") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "URLSTATS"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "USAGESTATS"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "DGIKLKFKLLIKCANFONKCABMBDFMGLEAG"; Value: "7B45C07ED630F7B265D035A6D3E7B95F1528484D0D8F280E31827F2A84317E9F") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "MHJFBMDGCFJBBPAEOJOFOHOEFGIEHJAI"; Value: "CB38267E1BDAE3AD0B8AFF4FAFE716C986A505D2E1941D12A9C94178209739A6")84:T119c,"start.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\start.exe]- [targetUID: 00000000-00005208] "python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\python313.dll]- [targetUID: 00000000-00005208] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libcrypto-3.dll]- [targetUID: 00000000-00005208] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libssl-3.dll]- [targetUID: 00000000-00005208] "pythoncom313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pythoncom313.dll]- [targetUID: 00000000-00006556] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00005208] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00005208] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\RarSFX0\webview\lib\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00005208] "pywintypes313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pywintypes313.dll]- [targetUID: 00000000-00006556] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00005208] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\RarSFX0\python3.dll]- [targetUID: 00000000-00006556] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\vcruntime140_1.dll]- [targetUID: 00000000-00005208] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00005208] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%TEMP%\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00005208] "WebBrowserInterop.x64.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\WebBrowserInterop.x64.dll]- [targetUID: 00000000-00006556] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\unicodedata.pyd]- [targetUID: 00000000-00005208] "cares.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\resolver\cares.pyd]- [targetUID: 00000000-00006556] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_decimal.pyd]- [targetUID: 00000000-00005208] "_corecffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\libuv\_corecffi.pyd]- [targetUID: 00000000-00006556] "_greenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\greenlet\_greenlet.pyd]- [targetUID: 00000000-00006556] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\pyexpat.pyd]- [targetUID: 00000000-00006556] "_gevent_cgreenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cgreenlet.pyd]- [targetUID: 00000000-00006556] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ssl.pyd]- [targetUID: 00000000-00005208] "_cffi_backend.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_cffi_backend.pyd]- [targetUID: 00000000-00005208] "_gevent_cqueue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cqueue.pyd]- [targetUID: 00000000-00006556]85:Ta3b,Found string "SetDllDirectoryW" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNEL32.DLL) Found string "SetDefaultDllDirectories" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "AreFileApisANSI" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: alpha_silverfox_scanner.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "log10" (Source: alpha_silverfox_scanner.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: alpha_silverfox_scanner.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: alpha_silverfox_scanner.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: alpha_silverfox_scanner.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: alpha_silverfox_scanner.exe, API is part of module: MSVCRT.DLL) Found string "SendMessageW" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "ShowWindow" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "GetDlgItem" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "SetDlgItemTextW" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "EnableWindow" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "SetWindowTextW" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "GetWindowTextW" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "GetWindowTextLengthW" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL) Found string "GetParent" (Source: alpha_silverfox_scanner.exe, API is part of module: USER32.DLL)86:T4ab,"start.exe" called "getaddrinfo" with parameters {"pNodeName": "edition.cnn.com" "pServiceName": "443" "pHints": "b1ed60c950" "ppResult": "2084d6d891020000"} "start.exe" called "getaddrinfo" with parameters {"pNodeName": "www.bbc.com" "pServiceName": "443" "pHints": "b1ecc9c6c0" "ppResult": "f08b07d891020000"} "start.exe" called "getaddrinfo" with parameters {"pNodeName": "www.xinhuanet.com" "pServiceName": "443" "pHints": "b1edf7c810" "ppResult": "8068d7d891020000"} "start.exe" called "getaddrinfo" with parameters {"pNodeName": "www.people.com.cn" "pServiceName": "3830" "pHints": "b1ee8ebe40" "ppResult": "c063d7d891020000"} "start.exe" called "getaddrinfo" with parameters {"pNodeName": "www.nytimes.com" "pServiceName": "443" "pHints": "b1efbcc410" "ppResult": "0064d7d891020000"} "start.exe" called "getaddrinfo" with parameters {"pNodeName": "127.0.0.1" "pServiceName": "5000" "pHints": "b1f639ded0" "ppResult": "a07de2d891020000"} "msedgewebview2.exe" called "GetUserGeoID" with parameters {"GeoClass": "16"} "msedgewebview2.exe" called "GetGeoInfoW" with parameters {"Location": "244" "GeoType": "4" "lpGeoData": "5439573" "cchData": "3" "LangId": "0"}87:T4ed,"alpha_silverfox_scanner.exe" reads file "C:\Windows\win.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "alpha_silverfox_scanner.exe" reads file "C:\Users\desktop.ini" "msedgewebview2.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini"88:T26bc,"start.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\start.exe]- [targetUID: 00000000-00005208] "python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\python313.dll]- [targetUID: 00000000-00005208] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libcrypto-3.dll]- [targetUID: 00000000-00005208] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\libssl-3.dll]- [targetUID: 00000000-00005208] "pythoncom313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pythoncom313.dll]- [targetUID: 00000000-00006556] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00005208] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00005208] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\RarSFX0\webview\lib\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00005208] "pywintypes313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\pywintypes313.dll]- [targetUID: 00000000-00006556] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00005208] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\RarSFX0\python3.dll]- [targetUID: 00000000-00006556] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\vcruntime140_1.dll]- [targetUID: 00000000-00005208] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00005208] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%TEMP%\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00005208] "WebBrowserInterop.x64.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\RarSFX0\webview\lib\WebBrowserInterop.x64.dll]- [targetUID: 00000000-00006556] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\unicodedata.pyd]- [targetUID: 00000000-00005208] "cares.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\resolver\cares.pyd]- [targetUID: 00000000-00006556] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_decimal.pyd]- [targetUID: 00000000-00005208] "_corecffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\libuv\_corecffi.pyd]- [targetUID: 00000000-00006556] "_greenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\greenlet\_greenlet.pyd]- [targetUID: 00000000-00006556] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\pyexpat.pyd]- [targetUID: 00000000-00006556] "_gevent_cgreenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cgreenlet.pyd]- [targetUID: 00000000-00006556] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ssl.pyd]- [targetUID: 00000000-00005208] "_cffi_backend.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_cffi_backend.pyd]- [targetUID: 00000000-00005208] "_gevent_cqueue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cqueue.pyd]- [targetUID: 00000000-00006556] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_lzma.pyd]- [targetUID: 00000000-00005208] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_elementtree.pyd]- [targetUID: 00000000-00006556] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\win32api.pyd]- [targetUID: 00000000-00006556] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ctypes.pyd]- [targetUID: 00000000-00005208] "md__mypyc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\charset_normalizer\md__mypyc.pyd]- [targetUID: 00000000-00005208] "_gevent_clocal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_clocal.pyd]- [targetUID: 00000000-00006556] "_gevent_c_hub_primitives.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_hub_primitives.pyd]- [targetUID: 00000000-00006556] "_gevent_c_semaphore.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_semaphore.pyd]- [targetUID: 00000000-00006556] "_gevent_c_abstract_linkable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_abstract_linkable.pyd]- [targetUID: 00000000-00006556] "_gevent_cevent.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cevent.pyd]- [targetUID: 00000000-00006556] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_bz2.pyd]- [targetUID: 00000000-00005208] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_socket.pyd]- [targetUID: 00000000-00005208] "win32evtlog.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\win32evtlog.pyd]- [targetUID: 00000000-00006556] "_gevent_c_imap.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_imap.pyd]- [targetUID: 00000000-00006556] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_asyncio.pyd]- [targetUID: 00000000-00006556] "_gevent_c_waiter.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_waiter.pyd]- [targetUID: 00000000-00006556] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00006556] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_hashlib.pyd]- [targetUID: 00000000-00005208] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_overlapped.pyd]- [targetUID: 00000000-00006556] "_gevent_c_greenlet_primitives.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_greenlet_primitives.pyd]- [targetUID: 00000000-00006556] "_gevent_c_hub_local.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_hub_local.pyd]- [targetUID: 00000000-00006556] "_gevent_c_ident.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_ident.pyd]- [targetUID: 00000000-00006556] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_wmi.pyd]- [targetUID: 00000000-00005208] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_multiprocessing.pyd]- [targetUID: 00000000-00006556] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_queue.pyd]- [targetUID: 00000000-00005208] "_zope_interface_coptimizations.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\zope\interface\_zope_interface_coptimizations.pyd]- [targetUID: 00000000-00006556] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\select.pyd]- [targetUID: 00000000-00005208] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_uuid.pyd]- [targetUID: 00000000-00005208] "_speedups.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\markupsafe\_speedups.pyd]- [targetUID: 00000000-00005208] "speedups.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\tornado\speedups.pyd]- [targetUID: 00000000-00006556] "md.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\charset_normalizer\md.pyd]- [targetUID: 00000000-00005208]89:T2767,"alpha_silverfox_scanner.exe" wrote 35160 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 50176 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 27992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_uuid.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 39768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\_wmi.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 37632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\libcrypto-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 39696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\libffi-8.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 8448 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\python3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 64000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\pywintypes313.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 33112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\select.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 22016 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\unicodedata.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 49776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\win32api.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 5120 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\win32evtlog.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 10752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\charset_normalizer\md.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\clr_loader\ffi\dlls\amd64\ClrLoader.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 35328 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\gevent\_gevent_c_greenlet_primitives.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 29696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\gevent\_gevent_c_hub_local.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 42496 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\gevent\_gevent_c_ident.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 47616 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\gevent\_gevent_c_imap.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 43008 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\gevent\_gevent_c_waiter.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\markupsafe\_speedups.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 1536 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\psutil\_psutil_windows.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "alpha_silverfox_scanner.exe" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\pythonnet\runtime\Python.Runtime.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...8a:T73c,"alpha_silverfox_scanner.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_910519640" with delete access "start.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\q1xk4maq" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\BrowserMetrics\BrowserMetrics-695DF9A9-1C68.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\BrowserMetrics-spare.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Local State" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\5b4665ce-8a81-486d-8643-c1dcda08f524.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\ShaderCache\index" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\ShaderCache\data_0" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\ShaderCache\data_1" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\ShaderCache\data_2" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\ShaderCache\data_3" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\234a529d-5ded-410c-b503-3a3df29b37bd.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Local State~RF408323.TMP" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpq_jfxzzv\EBWebView\Default\Extension Rules\CURRENT" with delete access8b:T10c8,"unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\unicodedata.pyd]- [targetUID: 00000000-00005208] "cares.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\resolver\cares.pyd]- [targetUID: 00000000-00006556] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_decimal.pyd]- [targetUID: 00000000-00005208] "_corecffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\libuv\_corecffi.pyd]- [targetUID: 00000000-00006556] "_greenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\RarSFX0\greenlet\_greenlet.pyd]- [targetUID: 00000000-00006556] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\pyexpat.pyd]- [targetUID: 00000000-00006556] "_gevent_cgreenlet.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cgreenlet.pyd]- [targetUID: 00000000-00006556] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ssl.pyd]- [targetUID: 00000000-00005208] "_cffi_backend.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_cffi_backend.pyd]- [targetUID: 00000000-00005208] "_gevent_cqueue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cqueue.pyd]- [targetUID: 00000000-00006556] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_lzma.pyd]- [targetUID: 00000000-00005208] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_elementtree.pyd]- [targetUID: 00000000-00006556] "win32api.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\RarSFX0\win32api.pyd]- [targetUID: 00000000-00006556] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_ctypes.pyd]- [targetUID: 00000000-00005208] "md__mypyc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\charset_normalizer\md__mypyc.pyd]- [targetUID: 00000000-00005208] "_gevent_clocal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_clocal.pyd]- [targetUID: 00000000-00006556] "_gevent_c_hub_primitives.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_hub_primitives.pyd]- [targetUID: 00000000-00006556] "_gevent_c_semaphore.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_semaphore.pyd]- [targetUID: 00000000-00006556] "_gevent_c_abstract_linkable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_abstract_linkable.pyd]- [targetUID: 00000000-00006556] "_gevent_cevent.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_cevent.pyd]- [targetUID: 00000000-00006556] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_bz2.pyd]- [targetUID: 00000000-00005208] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_socket.pyd]- [targetUID: 00000000-00005208] "win32evtlog.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\win32evtlog.pyd]- [targetUID: 00000000-00006556] "_gevent_c_imap.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\gevent\_gevent_c_imap.pyd]- [targetUID: 00000000-00006556] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\_asyncio.pyd]- [targetUID: 00000000-00006556]8c:T7ee,"start.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 1880) "start.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 1880) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 516) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 516) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000170 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 0000002C bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000020 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000108 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508) "msedgewebview2.exe" wrote 00000100 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.106\msedgewebview2.exe" (Handle: 2508)8d:T113e,Spawned process "alpha_silverfox_scanner.exe" (UID: 00000000-00006556) Spawned process "start.exe" (UID: 00000000-00005208) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007816) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=start.exe --user-data-dir="%TEMP%\\tmpq_jfxzzv\\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5208.2144.11694771121164529144 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74" (UID: 00000000-00007272) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\tmpq_jfxzzv\\EBWebView /prefetch:4 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.140 "--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=121.0.2277.106 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1bc,0x1e0,0x7ffe3c5fbf98,0x7ffe3c5fbfa4,0x7ffe3c5fbfb0" (UID: 00000000-00002792) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfxzzv\\EBWebView" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74" (UID: 00000000-00003660) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfxzzv\\EBWebView" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2512 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74" (UID: 00000000-00002196) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfxzzv\\EBWebView" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2680 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74" (UID: 00000000-00004264) Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%TEMP%\\tmpq_jfxzzv\\EBWebView" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --first-renderer-process --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1767762221888671 --launch-time-ticks=4234560112 --mojo-platform-channel-handle=3428 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74 /prefetch:1" (UID: 00000000-00007752)8e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4AAAAAAAAAAAAAAAAAD//+zuAAAAAAAAAAAAAAD////u7u4AAAAAAAAAAAD/////7u7u6AAAAAAAAAAP/////+7u7ujgAAAAAAAA///////u7u7u7gAAAAAAD///////7u7u7u7gAAAAAP///////+7u7u7u7gAAAA/////////u7u7u7u4AAAAP////////7u7u7u7u4AAAD////////+7u7u7u7vAAAP/////////u7u7u7u7gAAD/////////7u7u7u7u4AAA/////////+7u7u7u7u4AAP/////////u7u7u7u7uAAD/////////7u7u7u7u7gAA/////////+7u7u7u7u4AAP/////////u7u7u7u7uAAD/////////7u7u7u7u7gAA/////////+7u7u7u7u4AAP/////////u7u7u7u7uAAD/////////7u7u7u7u7gAA/////////+7u7u7u7u4AAP/////////u7u7u7u7uAAD/////////7u7u7u7u7gAA/wAP/////+7u7u6ADuAAAAAAAA/////u7s7gAAAAAAAAAAAAAP//7u4AAAAAAAAAAAAAAAAP/+4AAAAAAAAAAAAAAAAAAP/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////gP///gA///gAD//gAAf/wAAD/4AAAf8AAAD/AAAAfgAAAH4AAAA+AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA+AAAAP/gAH///AH///4H////D///////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790796825834,"unified_at":"2026-09-30T19:33:45.834Z","metadata":{"hashes":{"sha256":"7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a","sha1":"ab100eec3d3e719a6f2be77c18ab576bde575188","md5":"008b4ce967afd4768a13687e78f3e457","sha512":"969a8503f5d09df6fb8e93f8552fb239235ae68ecb5e159a21f2a142d87d366e0d8fc3b2327797f065f5829550f6cca9a91f9827791cc1ebd9acca05f92b5d6e","ssdeep":"393216:4Yfhg3o85vFF9v1j665oN1ZMGXBRfemBbpc9z8qlAEOe:Dgp11xoN1bPbG9z8qm0","ssdeep_chunks":["393216:4Yfhg3o","393216:Yfhg3o8","393216:fhg3o85","393216:hg3o85v","393216:g3o85vF","393216:3o85vFF","393216:o85vFF9","393216:85vFF9v","393216:5vFF9v1","393216:vFF9v1j","393216:FF9v1j6","393216:F9v1j66","393216:9v1j665","393216:v1j665o","393216:1j665oN","393216:j665oN1","393216:665oN1Z","393216:65oN1ZM","393216:5oN1ZMG","393216:oN1ZMGX","393216:N1ZMGXB","393216:1ZMGXBR","393216:ZMGXBRf","393216:MGXBRfe","393216:GXBRfem","393216:XBRfemB","393216:BRfemBb","393216:RfemBbp","393216:femBbpc","393216:emBbpc9","393216:mBbpc9z","393216:Bbpc9z8","393216:bpc9z8q","393216:pc9z8ql","393216:c9z8qlA","393216:9z8qlAE","393216:z8qlAEO","393216:8qlAEOe","786432:4Yfhg3o","786432:Yfhg3o8","786432:fhg3o85","786432:hg3o85v","786432:g3o85vF","786432:3o85vFF","786432:o85vFF9","786432:85vFF9v","786432:5vFF9v1","786432:vFF9v1j","786432:FF9v1j6","786432:F9v1j66","786432:9v1j665","786432:v1j665o","786432:1j665oN","786432:j665oN1","786432:665oN1Z","786432:65oN1ZM","786432:5oN1ZMG","786432:oN1ZMGX","786432:N1ZMGXB","786432:1ZMGXBR","786432:ZMGXBRf","786432:MGXBRfe","786432:GXBRfem","786432:XBRfemB","786432:BRfemBb","786432:RfemBbp","786432:femBbpc","786432:emBbpc9","786432:mBbpc9z","786432:Bbpc9z8","786432:bpc9z8q","786432:pc9z8ql","786432:c9z8qlA","786432:9z8qlAE","786432:z8qlAEO","786432:8qlAEOe","393216:Dgp11xo","393216:gp11xoN","393216:p11xoN1","393216:11xoN1b","393216:1xoN1bP","393216:xoN1bPb","393216:oN1bPbG","393216:N1bPbG9","393216:1bPbG9z","393216:bPbG9z8","393216:PbG9z8q","393216:bG9z8qm","393216:G9z8qm0"],"imphash":"c58a6fdd5514cc5114ad09dc07384b11"},"file_info":{"file_name":"alpha_silverfox_scanner.exe","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":16707635,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767737557000,"last_seen":1767737557000,"last_multi_scan":1767737557000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["commodity","targetedcrimeware","rat","targeted","cobaltstrike","criminal","evasive","suspicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":105},"sandbox_signatures":{"informative_count":277,"suspicious_count":19,"malicious_count":3,"total":299},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to convert data from binary to string"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Calls an API typically used to performs encryption on the data"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to remove the event logs"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Calls an API typically used to find device information"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"suspicious","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Tries to retrieve system manufacturer/productname details"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieves adapter information"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"},{"type":"informative","value":"Reads the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Found named pipe-like string used by malware"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to access browsers/wallets sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"User-Agent string indicates scripted web access"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Write many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"_lzma.pyd\")\n file/memory contains long string(File: \"_bz2.pyd\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove the event logs","description":"file/memory contains long string with (Indicator: \"evtclearlog\"; File: \"win32evtlog.pyd\")\n Found reference to API \"EvtClearLog\" (Indicator: \"evtclearlog\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"evtsetchannelconfigproperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00002792.00000001.272235.1C813000.00000004.mdmp\")\n Found reference to API \"evtsetchannelconfigproperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-738","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"alpha_silverfox_scanner.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00006556)\n \"alpha_silverfox_scanner.exe\" called \"FindResourceW\" with parameter \"654152\" - (UID: 00000000-00006556)\n \"start.exe\" called \"FindResourceA\" with parameter \"3\" - (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"105\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"153\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"187\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"190\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"321\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"323\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"291\" - (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"alpha_silverfox_scanner.exe\" called \"LoadResource with parameter {'hModule': '393216', 'hResInfo': '783200'}\" (UID: 00000000-00006556)\n \"start.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140696366031104'}\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"start.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\tmpq_jfxzzv (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003660.00000001.272844.355D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA384\"; File: \"libffi-8.dll\")\n file/memory contains long string with (Indicator: \"HMAC\"; File: \"_hashlib.pyd\")\n file/memory contains long string with (Indicator: \"SHA384\"; File: \"_hashlib.pyd\")\n file/memory contains long string with (Indicator: \"SHA512\"; File: \"_hashlib.pyd\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005208-00000BC0-3198360403\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\.\\.\\vk_swiftshader.dll; Source: \"00000000-00003660-00000C2B-3234224591\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"start.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 657C0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 657C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"Library dbghelp.dll is not loaded\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")\n Found string \"Library dbghelp.dll is not loaded\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007272-00000C2C-3220967671\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"$2e","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2f","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":2,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Encoding\" in header \"GET / HTTP/1.1Host: www.people.com.cnUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive\"\n Contains base64 string in header \"gzip\" in header \"GET / HTTP/1.1Host: www.people.com.cnUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive\"\n Contains base64 string in header \"keep\" in header \"GET / HTTP/1.1Host: www.people.com.cnUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"_gevent_clocal.pyd\")\n Found string \"https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff\" (Indicator: \"github.com\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff\" (Indicator: \"github.com\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"win32api.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$33","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"_psutil_windows.pyd\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"WTSOpenServerW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"WTSOpenServerA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002196-00000C2C-3239528493\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"win32api.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"alpha_silverfox_scanner.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006556)\n \"start.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"alpha_silverfox_scanner.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006556)\n \"alpha_silverfox_scanner.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"alpha_silverfox_scanner.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"alpha_silverfox_scanner.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006556)\n \"start.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"start.exe\" called \"IsWow64Process\" with parameter \"5208\" - (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"7272\" - (UID: 00000000-00007272)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"3660\" - (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"alpha_silverfox_scanner.exe\" called \"EnumWindows\" with parameter \"49275908\" - (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to find device information","description":"\"msedgewebview2.exe\" called \"SetupDiGetClassDevsW\" with parameters {\"ClassGuid\": \"541e6372a478d011bcf700aa00b7b32a\"\n \"Flags\": \"18\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-193","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"alpha_silverfox_scanner.exe\" called \"GetWindowTextW\" with parameter \"%TEMP%\\RarSFX0\" - (UID: 00000000-00006556)\n \"start.exe\" called \"GetWindowTextW\" with parameter \"Alpha\" - (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"Untitled - [InPrivate]\" - (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"msedgewebview2.exe\" called \"GetActiveWindow\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"alpha_silverfox_scanner.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"alpha_silverfox_scanner.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000007f7020000f702000000000000000000000000585401030000000000000000b8e9ef020200000010000000c001f70200000000020000000000f7020100000008000000000001030c0af70200000000080af70288f0ef02feba94770800000000000000080000008aa604b2ccf2ef02da912873000001030800000001000000 (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"alpha_silverfox_scanner.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006556)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"msedgewebview2.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"alpha_silverfox_scanner.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"alpha_silverfox_scanner.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"start.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"start.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00005208-00000C47-13341833338","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\n Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\RARSFX0\\WEBVIEW\\LIB\\WEBVIEW2LOADER.DLL\n %TEMP%\\RARSFX0\\WEBVIEW\\LIB\\RUNTIMES\\WIN-X64\\NATIVE\\WEBVIEW2LOADER.DLL\n %TEMP%\\RARSFX0\\CLR_LOADER\\FFI\\DLLS\\AMD64\\CLRLOADER.DLL\n %TEMP%\\RARSFX0\\RUNTIMES\\WIN-X64\\NATIVE\\WEBVIEW2LOADER.DLL\n WEBVIEW2LOADER.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"msedgewebview2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{E122B924-B4ED-4437-BC94-A96B6AA901B6}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"alpha_silverfox_scanner.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"start.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"start.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$41","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"alpha_silverfox_scanner.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"alpha_silverfox_scanner.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp, 00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"alpha_silverfox_scanner.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"alpha_silverfox_scanner.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"WebView2Loader.dll\")\n file/memory contains long string(File: \"win32api.pyd\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$43","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"alpha_silverfox_scanner.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\start.exe\"\" - (UID: 00000000-00006556)\n \"start.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00005208)\n \"start.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe\" --embedded-browser-webview=1 --webvie\" - (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe\" --type=utility --utility-sub-type=net\" - (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$44","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$46","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"ClrLoader.dll\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.people.com.cn\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"255.255.255.255:67\"\n \"255.255.255.255:9999\"\n \"151.101.131.5:443\"\n \"151.101.128.81:443\"\n \"156.225.111.22:443\"\n \"157.185.179.12:80\"\n \"151.101.193.164:443\"\n \"104.17.25.14:443\"\n \"143.92.35.2:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$47","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005208-00000C47-13341833338\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005208-00000C47-13341833338\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")\n Found reference to API \"AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$51","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$52","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$53","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$54","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\\n Found string - \\\\.\\pipe\\LOCAL\\mojo.5208.2144.11694771121164529144\n Found string - \\\\.\\pipe\\crashpad_7272_ADRBVJPTAWHMHGBI\n Found string - \\\\.\\pipe\\LOCAL\\mojo.7272.668.4638225886037022736\n Found string - \\\\.\\pipe\\LOCAL\\mojo.7272.668.1561993164023096759\n Found string - \\\\.\\pipe\\LOCAL\\mojo.7272.668.12876244869572759315\n Found string - \\\\.\\pipe\\LOCAL\\mojo.7272.668.2753416665859044725\n Found string - \\\\.\\pipe\\LOCAL\\mojo.7272.5156.600244375788013762\n Found string - \\\\.\\pipe\\LOCAL\\mojo.\n Found string - \\\\.\\pipe\\LOCAL\\crashpad_%lu_\n Found string - \\\\.\\pipe\\crashpad_%lu_\n Found string - CHROME_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_7272_ADRBVJPTAWHMHGBI","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$55","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002196.00000002.274813.00060000.00000004.mdmp, 00000000-00002196.00000002.274813.000C0000.00000004.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002196.00000002.274813.000EC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$56","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"alpha_silverfox_scanner.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73220000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"start.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 40050000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"start.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 62C90000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"alpha_silverfox_scanner.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76530000\n \"start.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6F6F0000\n \"start.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 70770000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 70770000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6F6F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"start.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 41610000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"alpha_silverfox_scanner.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77260000\n \"start.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 72890000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 72890000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 72890000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020423a70fe7f0000@ntdll.dll\"\n \"220023000000000040423a70fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$57","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: alpha_silverfox_scanner.exe, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$58","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00005208-00000BC0-3193977122]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005208-00000BC0-3194003097]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00005208-00000C47-13341833338]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00007816-00000BC0-3194150646]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cdn.bootcdn.net\"\n \"cdnjs.cloudflare.com\"\n \"edition.cnn.com\"\n \"www.bbc.com\"\n \"www.nytimes.com\"\n \"www.people.com.cn\"\n \"www.xinhuanet.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"alpha_silverfox_scanner.exe\" searching for class \"Edit\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"alpha_silverfox_scanner.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"WebBrowserInterop.x64.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\_queue.pyd\"\n \"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\_socket.pyd\"\n \"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\_ssl.pyd\"\n \"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\_uuid.pyd\"\n \"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\_wmi.pyd\"\n \"alpha_silverfox_scanner.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\libcrypto-3.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"alpha_silverfox_scanner.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"start.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$60","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"$61","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$63","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"alpha_silverfox_scanner.exe\" queries basic process information of the \"C:\\alpha_silverfox_scanner.exe\" (UID: 6556)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"alpha_silverfox_scanner.exe\" reads file \"c:\\alpha_silverfox_scanner.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"alpha_silverfox_scanner.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"alpha_silverfox_scanner.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\_queue.pyd\"\n \"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\_socket.pyd\"\n \"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\_ssl.pyd\"\n \"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\_uuid.pyd\"\n \"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\_wmi.pyd\"\n \"alpha_silverfox_scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rarsfx0\\libcrypto-3.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Crashpad\\throttle_store.dat\"\n \"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Crashpad\\settings.dat\"\n \"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\000001.dbtmp\"\n \"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp\"\n \"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp\"\n \"msedgewebview2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \",\"ping\":{\"r\":-2},\"targetingattributes\":{\"AppCohort\":\"rrf@0.04\",\"AppMajorVersion\" (Indicator: \"\"ping\"; Source: \"00000000-00002196.00000002.274813.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"_corecffi.pyd\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" connect \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" bind \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"_overlapped.pyd\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"select.pyd\")\n Found reference to API \"forged shutdown request, got:\" (Indicator: \" shutdown \"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")\n Found reference to API \"forged shutdown request, got:\" (Indicator: \" shutdown \"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"gevent\\_gevent_c_imap.pyd\" [Source: 00000000-00006556-00000C2E-7085384686]\n Observed email domain:\"\\\\?\\%temp%\\rarsfx0\\gevent\\_gevent_c_imap.pyd\" [Source: 00000000-00006556-00000C2E-7086154064]\n Observed email domain:\"silverpop.com/\" [Source: 00000000-00002196.00000002.274813.000C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found named pipe-like string used by malware","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00007272-00000CCE-3216992345\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002196.00000002.274813.000EC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\nHost: www.people.com.cn\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip\n deflate\nAccept: */*\nConnection: keep-alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cdnjs.cloudflare.com\" has high entropy\n Contacted domain: \"www.xinhuanet.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Reads the hosts file","description":"\"msedgewebview2.exe\" read 4096 bytes from file \"C:\\Windows\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"NDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00002196.00000002.274813.00060000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00002196.00000002.274813.00074000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:5000\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"cdn.bootcdn.net\" (89 days old)\n Short term registered certificate: \"cdnjs.cloudflare.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"User-Agent string indicates scripted web access","description":"Found scripted User-Agent python-requests/2.32.5","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"151.101.131.5\" on port \"443\"\n HTTPS traffic to \"151.101.128.81\" on port \"443\"\n HTTPS traffic to \"156.225.111.22\" on port \"443\"\n HTTPS traffic to \"151.101.193.164\" on port \"443\"\n HTTPS traffic to \"104.17.25.14\" on port \"443\"\n HTTPS traffic to \"143.92.35.2\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"Microsoft.Web.WebView2.WinForms.dll\"\n YARA signature for RSA public and private key matched on file \"Python.Runtime.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Web.WebView2.Core.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002196.00000001.272894.FA813000.00000004.mdmp, 00000000-00002196.00000002.274813.FA813000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"file/memory contains long string with (Indicator: \"kerberos\"; File: \"win32evtlog.pyd\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"win32api.pyd\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"alpha_silverfox_scanner.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$70","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"alpha_silverfox_scanner.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"start.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"24\"\n \"th32ProcessID\": \"7272\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"msedgewebview2.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"o6dHQRyMUxi2XrL\"\n \"Sid\": \"487856262624\"\n \"cbSid\": \"44000000\"\n \"cchReferencedDomainName\": \"80000000\"\n \"peUse\": \"aaaaaaaa\"}\n \"msedgewebview2.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"o6dHQRyMUxi2XrL\"\n \"Sid\": \"487856262800\"\n \"cbSid\": \"44000000\"\n \"cchReferencedDomainName\": \"80000000\"\n \"peUse\": \"aaaaaaaa\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"msedgewebview2.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"20000000aaaaaaaa105a020050630000\"\n \"szDataDescr\": \"635000022840\"\n \"pDataOut\": \"2201000000000000003ec80f22020000\"\n \"$datain\": \"ab24ac70f797f9ea01e67c339f3a5d2f89a2f296af7890a79489b7d27586b2d9\"\n \"$datadescr\": \"Microsoft Edge\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"start.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"msedgewebview2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$71","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$72","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability retrieve IPv4 mapping information (API string)","description":"Found reference to API \"GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00003660.00000000.270924.E0A13000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-87","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00003660.00000001.272844.355D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"153889311016,5616,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"01:11:33.734\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002196.00000002.274813.FA800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp\")\n Found reference to API \"eglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00002196.00000000.270974.FA813000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$79","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"config.edge.skype.com\" (Indicator: \"skype.com\")\n \"*.config.skype.com\" (Indicator: \"skype.com\")\n \"config.edge.skype.com0\" (Indicator: \"skype.com\")\n \"config.edge.skype.com.trafficmanager.net\" (Indicator: \"skype.com\")\n \"ln-0007.config.skype.com\" (Indicator: \"skype.com\")\n \"config.edge.skype.com/config/v1/Edge/121.0.2277.106?clientId=2219359863310145711&agents=EdgeRuntimeConfig%2CEdgeDomainActions&osname=win&client=webview&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.22621&wu=1&devicefamily=desktop&uma=0&sessionid=0&mngd=0&installdate=1767766442&edu=0&soobedate=1684931814&fg=1\" (Indicator: \"skype.com\")\n \"ectionconfig.edge.skype.com\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"VULKANIMPLICITLAYERS\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"VULKANEXPLICITLAYERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access browsers/wallets sensitive information (file access)","description":"\"msedgewebview2.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\MANIFEST-000001\"\n \"msedgewebview2.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\000003.log\"\n \"msedgewebview2.exe\" trying to open a file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\\"\n \"msedgewebview2.exe\" trying to open a file \"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\CURRENT\"\n \"msedgewebview2.exe\" trying to open a file \"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\MANIFEST-000001\"\n \"msedgewebview2.exe\" trying to open a file \"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\000003.log\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to retrieve system manufacturer/productname details","description":"\"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMMANUFACTURER\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMPRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-115","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"NtDeleteKey\" in \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"start.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\n 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\n 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$81","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; Source: \"00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"alpha_silverfox_scanner.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.355D0000.00000002.mdmp, 00000000-00003660.00000001.272844.35BEA000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp, 00000000-00003660.00000001.272844.447F7000.00000002.mdmp, 00000000-00003660.00000001.272844.448A1000.00000002.mdmp, 00000000-00003660.00000001.272844.44C5F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"start.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"start.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"A2729FC39C7FDC010000000000000000000000000200000000\")\n \"msedgewebview2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"msedgewebview2.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\PREFERENCEMACS\\DEFAULT\"; Key: \"EXTENSIONS.SETTINGS\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"alpha_silverfox_scanner.exe\" opened \"\\Device\\KsecDD\"\n \"start.exe\" opened \"\\Device\\KsecDD\"\n \"msedgewebview2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$82","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$83","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp, 00000000-00002196.00000000.270974.ABAE5000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002196.00000000.270974.3C54D000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003660.00000000.270924.ABAE5000.00000002.mdmp, 00000000-00003660.00000001.272844.3C54D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$84","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"alpha_silverfox_scanner.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"informative","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"msedgewebview2.exe\" write more than 100 files with extension \".7272.668.4638225886037022736\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"alpha_silverfox_scanner.exe\" at 00000000-00006556-00000C15-3185148457\n \"start.exe\" at 00000000-00005208-00000C15-3200449628\n \"msedgewebview2.exe\" at 00000000-00007272-00000C15-3224697794","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"start.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":1,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"start.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5208)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"$86","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"start.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005208)\n \"msedgewebview2.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$87","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 255.255.255.255\"\n \"UDP connection to 104.17.25.14\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$88","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$89","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 151.101.131.5 on port 443 is sent without HTTP header\n TCP traffic to 151.101.128.81 on port 443 is sent without HTTP header\n TCP traffic to 156.225.111.22 on port 443 is sent without HTTP header\n TCP traffic to 157.185.179.12 on port 80 is sent without HTTP header\n TCP traffic to 151.101.193.164 on port 443 is sent without HTTP header\n UDP traffic to 104.17.25.14 on port 443\n TCP traffic to 104.17.25.14 on port 443 is sent without HTTP header\n TCP traffic to 143.92.35.2 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"python313.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"python313.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in process \"00000000-00005208\"\n YARA signature matched on RAR SFX file \"sample.bin\"\n YARA signature matched on Chacha20 instruction used in file \"python313.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1145 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"alpha_silverfox_scanner.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$8a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"alpha_silverfox_scanner.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"start.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$8b","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"alpha_silverfox_scanner.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\start.exe\"\" - (UID: 00000000-00006556)\n \"start.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe\" --embedded-browser-webview=1 --webvie\" - (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$8c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$8d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":188,"dropped_files_count":0,"extracted_files_count":35,"files_written_count":665,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":7,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","targetedcrimeware","rat","targeted","cobaltstrike","criminal","evasive","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"695d88d2c6a9f8858d052580","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["SGP","SYC","USA","ZZZ"],"submit_name":"alpha_silverfox_scanner.exe","analysis_start_time":"2026-01-06T22:12:38+00:00","indicators_count":{"informative":277,"suspicious":51,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"255.255.255.255","port":67,"protocol":"UDP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"255.255.255.255","port":9999,"protocol":"UDP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"151.101.131.5","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"151.101.128.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"156.225.111.22","port":443,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"157.185.179.12","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"151.101.193.164","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"104.17.25.14","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"address":"143.92.35.2","port":443,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"dns_resolutions":[{"domain":"cdn.bootcdn.net","address":"143.92.35.2","ttl":59,"country":"Singapore","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"cdnjs.cloudflare.com","address":"104.17.25.14","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"edition.cnn.com","address":"151.101.131.5","ttl":2,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"www.bbc.com","address":"151.101.128.81","ttl":19612,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"www.nytimes.com","address":"151.101.193.164","ttl":565,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"www.people.com.cn","address":"157.185.179.12","ttl":266,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"domain":"www.xinhuanet.com","address":"156.225.111.22","ttl":42,"country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"http_requests":[{"host":"www.people.com.cn","host_ip":"157.185.179.12:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: www.people.com.cn\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}],"processes":[{"pid":6556,"ppid":0,"name":"alpha_silverfox_scanner.exe","command_line":"","sha256":"7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a","normalized_path":"C:\\alpha_silverfox_scanner.exe","uid":"00000000-00006556","icon":"$8e"},{"pid":5208,"ppid":6556,"name":"start.exe","command_line":"","sha256":"bc752ef7d3adf4ea58a02d082980cf50057de1cee5e9ca7b5ddd43fd0588b549","normalized_path":"%TEMP%\\RarSFX0\\start.exe","parent_uid":"00000000-00006556","uid":"00000000-00005208"},{"pid":7816,"ppid":5208,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005208","uid":"00000000-00007816"},{"pid":7272,"ppid":5208,"name":"msedgewebview2.exe","command_line":"--embedded-browser-webview=1 --webview-exe-name=start.exe --user-data-dir=\"%TEMP%\\tmpq_jfxzzv\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5208.2144.11694771121164529144 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00005208","uid":"00000000-00007272"},{"pid":2792,"ppid":7272,"name":"msedgewebview2.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\tmpq_jfxzzv\\EBWebView /prefetch:4 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.140 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe\" --annotation=plat=Win64 \"--annotation=prod=Edge WebView2\" --annotation=ver=121.0.2277.106 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1bc,0x1e0,0x7ffe3c5fbf98,0x7ffe3c5fbfa4,0x7ffe3c5fbfb0","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00007272","uid":"00000000-00002792"},{"pid":3660,"ppid":7272,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%TEMP%\\tmpq_jfxzzv\\EBWebView\" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00007272","uid":"00000000-00003660"},{"pid":2196,"ppid":7272,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"%TEMP%\\tmpq_jfxzzv\\EBWebView\" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2512 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00007272","uid":"00000000-00002196"},{"pid":4264,"ppid":7272,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%TEMP%\\tmpq_jfxzzv\\EBWebView\" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2680 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00007272","uid":"00000000-00004264"},{"pid":7752,"ppid":7272,"name":"msedgewebview2.exe","command_line":"--type=renderer --noerrdialogs --user-data-dir=\"%TEMP%\\tmpq_jfxzzv\\EBWebView\" --webview-exe-name=start.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --first-renderer-process --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags=\"--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=\" --time-ticks-at-unix-epoch=-1767762221888671 --launch-time-ticks=4234560112 --mojo-platform-channel-handle=3428 --field-trial-handle=1888,i,13839063366088478240,1114351218932751631,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:fe06c7614c2d607eff1cae0183f3992f7dd90a74 /prefetch:1","sha256":"09c07af5ebe918374e23a515e8b22047617c0c320e21aaaf7a18fc1aedec9750","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\121.0.2277.106\\msedgewebview2.exe","parent_uid":"00000000-00007272","uid":"00000000-00007752"}],"all_imported_dlls":["shlwapi.dll","urlmon.dll","netutils.dll","KBDUS.DLL","umpdc.dll","DXCore.dll","mfperfhelper.dll","d3d11.dll","sechost.dll","sfc_os.dll","riched20.dll","System.ni.dll","Accessibility.ni.dll","samcli.dll","d3d10warp.dll","wbemsvc.dll","KernelBase.dll","msvcrt.dll","VxSSL32.dll","version.dll","usp10.dll","TextShaping.dll","wow64win.dll","libcrypto-3.dll","nsi.dll","powrprof.dll","ServicingCommon.dll","vcruntime140.dll","System.Drawing.ni.dll","wkscli.dll","mscms.dll","dxgi.dll","kernel32.dll","FWPUCLNT.DLL","BitsProxy.dll","RTWorkQ.dll","libEGL.dll","ntdll.dll","virtdisk.dll","4P27ifyz.dll","System.Xml.ni.dll","gdi32.dll","dwmapi.dll","fastprox.dll","ucrtbase_clr0400.dll","wow64con.dll","edputil.dll","userenv.dll","clr.dll","mdmregistration.dll","omadmapi.dll","Windows.UI.dll","wtsapi32.dll","user32.dll","TextInputFramework.dll","python313.dll","System.Configuration.ni.dll","ResourcePolicyClient.dll","uxtheme.dll","AssignedAccessRuntime.dll","linkinfo.dll","ntasn1.dll","wow64.dll","shell32.dll","vcruntime140_1.dll","mswsock.dll","amsi.dll","oleacc.dll","TenantRestrictionsPlugin.dll","mfplat.dll","comctl32.dll","WindowsCodecs.dll","VxSSL64.dll","IPHLPAPI.DLL","rasadhlp.dll","mscoree.dll","Windows.Security.Authentication.Web.Core.dll","ncrypt.dll","advapi32.dll","clbcatq.dll","OneCoreCommonProxyStub.dll","CryptoWinRT.dll","libGLESv2.dll","win32u.dll","tiptsf.dll","windows.storage.dll","profapi.dll","twinapi.appcore.dll","winmm.dll","policymanager.dll","ucrtbase.dll","SHCore.dll","System.Core.ni.dll","CorePrivacySettingsStore.dll","directmanipulation.dll","msctf.dll","srvcli.dll","psapi.dll","gpapi.dll","dpapi.dll","UIAutomationCore.dll","d3dcompiler_47.dll","ffmpeg.dll","WinTypes.dll","cfgmgr32.dll","AppResolver.dll","apphelp.dll","mpr.dll","telclient.dll","vk_swiftshader.dll","dcomp.dll","vcruntime140_clr0400.dll","BCP47Langs.dll","wshbth.dll","msvcp110_win.dll","bcryptprimitives.dll","winrnr.dll","netapi32.dll","pcacli.dll","crypt32.dll","nlansp_c.dll","wbemprox.dll","MpOAV.dll","directxdatabasehelper.dll","ws2_32.dll","ole32.dll","setupapi.dll","libssl-3.dll","dbghelp.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","winsta.dll","rpcrt4.dll","wow64cpu.dll","vcruntime140_1_clr0400.dll","mscorlib.ni.dll","EmbeddedBrowserWebView.dll","msedge.dll","winhttp.dll","gdi32full.dll","rsaenh.dll","Windows.StateRepositoryPS.dll","wldp.dll","WebView2Loader.dll","twinapi.dll","dhcpcsvc.dll","vulkan-1.dll","kernel.appcore.dll","OneCoreUAPCommonProxyStub.dll","bcrypt.dll","pnrpnsp.dll","DWrite.dll","DataExchange.dll","wintrust.dll","combase.dll","msls31.dll","wbemcomn.dll","ClrLoader.dll","mscoreei.dll","dsreg.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","InputHost.dll","oleaut32.dll","fltLib.dll","cryptsp.dll","libffi-8.dll","Windows.StateRepositoryCore.dll","mf.dll","wow64base.dll","msvcp_win.dll","GdiPlus.dll","ntmarta.dll","clrjit.dll","DiagnosticDataSettings.dll","dhcpcsvc6.dll","CoreMessaging.dll","sspicli.dll","cryptbase.dll","NapiNSP.dll","System.Windows.Forms.ni.dll","msedge_elf.dll","oneds.dll","msasn1.dll","devobj.dll","imm32.dll","propsys.dll","iertutil.dll","dnsapi.dll","DolbyDecMFT.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_lzma.pyd","sha256":"71387e8484088f8291664312d985f42454017e1f556bd4107e2d065f19a799ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"libcrypto-3.dll","sha256":"e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"python313.dll","sha256":"b5315e8251fad9f1ad7304fcea4beb63f58ecd12754911e6de3f25f25d5f73e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Python.Runtime.dll","sha256":"d204ad74dc18cd07320c8e665bd32ec6549b555ce97e61e4d3cf88437a64988e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"start.exe","sha256":"85fb125d58cc3c7c7e5e1b82a012f8f1faec9e9faeeebf19c48d2acda98cdd97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Microsoft.Web.WebView2.Core.dll","sha256":"cb8c852fcc4ef55d630b64d171dc11538bb25258041ed22cf31735982a2e09e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Microsoft.Web.WebView2.WinForms.dll","sha256":"e62056bee28ab094071144b47371009a6fbc162f9aea184719f2e86ed515f7f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_asyncio.pyd","sha256":"a39fd4fb66de434321843b3c7775f22ec3bf75eb56bec8555d2b30e927a21997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_bz2.pyd","sha256":"b4aa26c44a529de7129733a31b73fd74e474b9069edf02d3151d067ac5d52a5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_cffi_backend.pyd","sha256":"d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_ctypes.pyd","sha256":"69ccbfa336004742c18fba4a2d0d24aba5f5e1578983278137788166ea322a22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_decimal.pyd","sha256":"098b917a449a82050820fd4b36b94cff85b243af5d109fdaefc1dff05efccca2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_elementtree.pyd","sha256":"efa8e1818f8c5139bd8f1a8916dead7455af16886e46bfe09cc2d03cdc2854f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_hashlib.pyd","sha256":"1ca43d7db5e5b3d8066038ff452b09c1dd525022ad5c4447be94345705caadc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_multiprocessing.pyd","sha256":"571784c49fe61b582713274368cab183136374b4fed34a2fbda621755225580b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_overlapped.pyd","sha256":"4df270d8693d16f34188f98b66b02d18a57bcc703339163d3f0570149caadd3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_queue.pyd","sha256":"f1be4ad7af2810ca957ce1bb6122ac821bb284633bdabc872e12e699f5067269","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_socket.pyd","sha256":"6050e57e93872e3cd86daeca9594362ad256a9bbe00e0549fa5988a9b43c90e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_ssl.pyd","sha256":"5f113a6b4cc933646ef69aa233da278bd311f7f04135a8ea6e1514944af3f851","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_uuid.pyd","sha256":"5a69ec3bc4b082b03f84fdad1d9a67d00575c5b23fdd3776607e4653376611cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_wmi.pyd","sha256":"440ccba82699e5cca4975ad68fa4338d66295dbf9abf391b924ed1d22fe90857","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"md.pyd","sha256":"89d8172b5f460c3fd85716c9641643fd7d893365a99867df4471b017f2995695","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"md__mypyc.pyd","sha256":"3ccacfdbf227750083980a7de0c982be26dfebac26e4fa599d1e7a5866e92a21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"ClrLoader.dll","sha256":"e6cb8b51dbd5d5b5548696e6ddf17875af73b8abd99ca1572d32b1df98028591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_gevent_c_abstract_linkable.pyd","sha256":"87f395f145b25048bd75dde2158206c4e49553a547e6c90599ee6dbb6a3184a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"_gevent_c_greenlet_primitives.pyd","sha256":"8db17dad5c58629c1532d5e7e6048017c560c5d90471c3878017288511caea8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"libssl-3.dll","sha256":"1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"python3.dll","sha256":"f950ce3bf381d5ffae90cf63ec9c9761f1666d9a570e2f203a7f22da6f8e14f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"pythoncom313.dll","sha256":"e312c8edb2d43a014daddfa984a805e6b5f933c60777e7b527332e682d9b1813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"pywintypes313.dll","sha256":"9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"vcruntime140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"vcruntime140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"WebBrowserInterop.x64.dll","sha256":"f6a646470f0e1058224a52e8e2e217501dca46939b30bfc9a5dd4dcdd43f088d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"pywebview-android.jar","sha256":"3f9d3eeeda09ce58badbd742a981a463c067c339c8b4e70b404c00ebb4ec73a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"WebView2Loader.dll","sha256":"271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\__tmp_rar_sfx_access_check_910519640","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\python3.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\python313.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\pythoncom313.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\pywintypes313.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\select.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\start.exe","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\win32api.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\win32evtlog.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\charset_normalizer\\md.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\charset_normalizer\\md.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\charset_normalizer\\md__mypyc.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\gevent\\libuv\\_corecffi.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\libuv\\_corecffi.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\gevent\\resolver\\cares.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\resolver\\cares.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\gevent","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_cevent.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_cgreenlet.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_clocal.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_cqueue.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_abstract_linkable.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_greenlet_primitives.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_hub_local.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_hub_primitives.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_ident.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_imap.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_semaphore.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\gevent\\_gevent_c_waiter.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\greenlet\\_greenlet.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\greenlet\\_greenlet.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\markupsafe\\_speedups.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\markupsafe\\_speedups.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\pythonnet\\runtime\\Python.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\pythonnet\\runtime\\Python.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\templates\\index.html","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\templates\\index.html","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\tornado\\speedups.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\tornado\\speedups.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\js\\api.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\api.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\customize.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\finish.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\js\\lib\\dom_json.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\lib\\dom_json.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\lib\\polyfill.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\js\\state.js","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib\\Microsoft.Web.WebView2.Core.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\lib\\Microsoft.Web.WebView2.Core.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\lib\\Microsoft.Web.WebView2.WinForms.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\lib\\pywebview-android.jar","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib\\runtimes\\win-x64\\native\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\lib\\runtimes\\win-x64\\native\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\webview\\lib\\WebBrowserInterop.x64.dll","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\zope\\interface\\_zope_interface_coptimizations.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\zope\\interface\\_zope_interface_coptimizations.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_cffi_backend.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\RarSFX0\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib\\runtimes\\win-x64\\native","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\clr_loader\\ffi\\dlls\\amd64","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib\\runtimes\\win-x64","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\clr_loader\\ffi\\dlls","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\js\\lib","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\webview\\lib\\runtimes","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\clr_loader\\ffi","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\gevent\\libuv","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\gevent\\resolver","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\pythonnet\\runtime","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\zope\\interface","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\certifi","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\charset_normalizer","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\clr_loader","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\greenlet","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\markupsafe","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\psutil","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\pythonnet","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\templates","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\tornado","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"C:\\zope","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wfwhwyxl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\opiobuti.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dkapnysz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qezqgbtf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cgqbctek.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vyopoxfc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gfnidjpb.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wqjxtqpe.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lugbzwiq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\omfamhvd.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\czzphnad.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gtatajpg.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kmluarnd.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lqsubuli.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bccgxktb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\blptawur.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\utqakvra.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nnfuaiac.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qugsdger.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pyrlnkvu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dzkpdswl.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hgztomeg.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\girjcwpv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hredalir.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hzijbuwv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jujqdjcg.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hwwouewl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cpjonskz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ffycpzdo.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rajvlbgv.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qrmkcuan.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hxaiiybs.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fyvkyixq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\waoajtbu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ezxoenlk.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pgffapwh.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zruphupo.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\okmtfnhj.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zrjntnje.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\btckignp.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\empmqogh.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aqeovpey.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lxngsqil.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cmlkzicj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aamvnsno.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rpsepagf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zujbdqcu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mpyjnozd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\llypkeut.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xazexaoh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qqokioje.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cktykwbk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ihnracwb.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vmmtzpgr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ruhlmmpt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tragrvnl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xorqgjgn.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qazukroz.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\plejoznp.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fbpchopw.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ipxvknaa.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\krnmqzjr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kvrhblab.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bglcocpc.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lhipmmxi.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pcydqshd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\iuspjoat.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\umdthjvl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ypmcbalo.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fomlhplj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bpszfvoi.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\clyocfve.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yxpmbmgu.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\udulxrer.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cubqhxiv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ivrzrdwo.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cuiqkicb.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ubhgxvot.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eqrzwydz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rikyexyw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gnqalwee.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\anjnietw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pqyhtzoz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dlioojgf.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zxupbqfn.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gzacuryl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xnkkgmag.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ilzzvlcv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zakokilr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zroiedin.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\grqjfftt.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dkxvmzly.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gqseytfu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pvxxxypu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\auwtclll.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ircmbfev.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yhqasqni.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nrljumsf.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lgvkcrgu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ddlpmowk.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ohyhknws.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bbaxnfvk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jxattfui.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\sdvzhbuz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yjvdmqds.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uyxkkdsr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jhxsccpb.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wktdngvr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lajgtxaz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ghqduqqb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xdutchzz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ytkukilk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cufchjgh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\shmmyaer.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qgwvwzbf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mvrwrhos.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\teidimrl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eyverzoa.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\elhorbip.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\epmfizde.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dcqghuew.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nthfuatl.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\efonfwpq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ofrktxyu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cqbnujod.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ajxefkbe.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lwzazkat.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wcqfzrrh.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dgqfxkvm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hdxarxxy.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ltxrrqbj.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ovyrwifj.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vbpynmwh.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ukgbxbao.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yruhrtnd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qpvkrhxe.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aybbqblz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ctbcxczq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\euufxrqn.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zolanrfa.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zbjychmu.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kgaunsmm.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ejfxhtao.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xypbqjoq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xufhdjef.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fdoyclku.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vusghiyk.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\otvlxmox.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\todqnuip.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pkmsifxm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kcprpemt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\caxyalrq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\drvttrow.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zhlwscwm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tjpwxibb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nrnrtuez.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pyxmggtx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\epacwzfm.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\oiafedzo.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uevzpvps.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ipnadfci.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zecduviy.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zbtwtqmh.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yuhgtddf.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\diaumzob.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nhpcercq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ocdhdrcz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dyolvxxr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\txyadguv.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tfrbmtwi.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lqmxolef.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uyewleeg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rzaqeuzt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cuijqffb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jeaihjey.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\noaaehnu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lardxyet.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nbkwbimh.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dcrnlekd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lbgjfuqr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zyffyhvu.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vavejxpk.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wkbflewx.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dxpenttp.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tjkiluva.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vssodyqd.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\piwueadp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\awhicajs.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nrcjiehi.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xsbbavlc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bzvzvwhl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kcocthav.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cjwgcqma.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qvccsfxn.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cnaayrdf.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\orlblwcz.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cpseifpn.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ipliemot.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dgtcwarv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wokqbfiu.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pqqhbxah.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\piuyxzde.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\syasngrm.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zhuaudbc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hlfpfwof.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zudnuoei.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kzbruuwn.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hkeznlxr.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fqmbscah.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dtlrtpvd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kxbulerb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hktdrggq.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cbwvfusf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dsducjii.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bpugdast.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tgsrmnvw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rdesdyie.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\sqbyrsow.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hioepxrp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\okedbgdg.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qqsiethy.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\quwkgiyk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mjuopjdy.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ifywzhkj.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gdylluum.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vbtlbttq.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\omunfisz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xjxjnrtx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bcbcprai.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uashojvm.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wmzqxzcc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\neuuqywg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tslzvubc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gyirlsub.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\negxgoes.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aezeukej.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dkesnpze.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zoroxvdt.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\iwfrsvtr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ungkhagb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cghswptb.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gttxgxke.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uqzffmox.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dhhtghnm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\okwubgwf.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lgxcuman.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\flhmrkrg.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\egtuozkz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vvsrgyor.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jactdwic.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kxwsgwlp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wtoajffl.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lzstxwuf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\sreyqthr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mqqyumui.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\huidrkkt.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vmowlmsz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\suqtwurt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jhttbyqm.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nvtqopkj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zjsngyqo.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fukirwsi.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jqcsyvfq.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hsgiuaax.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\phmldjid.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\adhkrprx.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ueyyefem.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pcaiyblk.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kpxsfdyd.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ejrcdjhm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cdfieaqn.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qimusoah.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ckgiknfv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\axhuiaqe.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ttafgbkf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eidselge.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bhzpgnny.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pycetwgv.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ngrfikfj.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vozhmnlc.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ymftpxae.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fzacpzqy.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jndjeeek.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pkvtjokt.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hooribdt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\sqrvshsd.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dsljaben.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tsnlqkve.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vkpaltfm.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hxuyascj.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wppjtdua.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lodquuon.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pkaxdqsp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zwusoqqx.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\imtebumx.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tllczamw.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xxdvvpes.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cariyvpa.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tzhxudvd.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cdxstrwc.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rmnidogo.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\apwdbqty.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lbkavcmp.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bqlyhzdh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mvsnpeyj.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jlwhfskv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qwmhhzgs.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vwqzljap.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nuwuyomy.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zvxcyzza.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dzodxtwx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zkzwbstx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uworhplv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\odtdabuf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\saidchex.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zdtfeqeh.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\danuifds.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bkpagbiz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hfkvqndp.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\exzxhrth.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vqxxuqjt.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kxflmhmt.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jbecdwrj.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fqfvbvhb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rvfytgau.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uprtpvoh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lqhpvhrq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mcgqcpgg.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eziieacq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\igfaktzz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bxxcrhnd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\izntkvqk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vdkcfhbl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aamvuynt.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\evvquwdn.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ylygnytl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zxdgdynq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eoeugvrw.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ccmczbdy.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xhegxmma.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bpwbugcw.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\aadtydbz.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yrkgghsc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gcxayfpu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jxbtkknr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ojkgxovg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cmxoyjwc.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nbydlvgl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fulpxisz.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yqvdqvmk.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\iqcabpiw.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wvlkwdya.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rebamykv.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mgcmvjul.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xgqgkfyg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zlbkhlxv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bwubxflx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nfdohyxr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cxqltjxh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jiukqokg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jttlkwkc.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\wdkxysza.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rdbxglpp.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rkspoagx.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xsdwcthb.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qsdzcymj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qwhcolaz.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\drfnrrgm.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xahbinyz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\eqivixxh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fathulvt.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nujjwprh.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jcvqerdq.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uukseeyt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hpdrvwxg.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cgjgcyls.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ymedmqgw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\btuqrqhg.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jymdyral.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fzrxvqyl.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\venbwkds.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xcnciclu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\drfuvden.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xkrxnlem.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mcszxrvy.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\naccslyg.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pwjycfwx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gkrdphgi.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ijeblbut.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\qfwurwzu.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ajafertw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\icvvvpsk.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\rueynhde.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gkvkhdhf.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ufvszqru.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yrnviona.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\givordbz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\adzqkjef.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nfapokjs.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\cimembpp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\yngfigcu.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\piczakds.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hkdjafml.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vzpvhyiq.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ndrgbxcl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\erdkdqfr.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\grdygtay.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\pdsubryf.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\dgrivsjh.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\sknwrvft.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kcigrhmj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\weorwlyd.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\znpicbpu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\oqwzphjp.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\epmqwnoq.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\njuzgehf.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fjnsppch.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\axntflbj.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\kgcsemui.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\iiguyvnv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\oxlxjbmh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\tturbrqo.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\hvolgmpl.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lbkmmcdt.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zinhewxd.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ilzvoaty.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mtpndgil.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\zzyskkcx.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\lqzldxeg.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xizzchby.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\fpijxeti.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uipgqwxk.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jbntcoyh.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\xawyefvv.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\mverypsb.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vjulkakp.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ubigjxyr.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\vfzlpcfe.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bdulwvvp.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uuwpwyqu.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ukatrlqb.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\klcphrpe.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\iemvjsli.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\ltkcktac.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\bomizmri.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\uuqezgei.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\nmxggmhd.bitcoin","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\gzvvyvcz.encrypted","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%USERPROFILE%\\Favorites\\jvewbzkw.key","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad\\throttle_store.dat","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\crashpad_7272_ADRBVJPTAWHMHGBI","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\BrowserMetrics\\BrowserMetrics-695DF9A9-1C68.pma","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\lockfile","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Variations","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\5b4665ce-8a81-486d-8643-c1dcda08f524.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.7272.668.4638225886037022736","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\ShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\ShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\ShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\ShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Last Version","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\README","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\History","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\discounts_db\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\discounts_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\234a529d-5ded-410c-b503-3a3df29b37bd.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.5208.2144.11694771121164529144","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Local State~RF408323.TMP","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Favicons-journal","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\f459df38-33c6-4f72-871e-4391b8563f67.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Local State~RF408390.TMP","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.7272.668.1561993164023096759","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.7272.668.12876244869572759315","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Visited Links","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.7272.668.2753416665859044725","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"pipe\\LOCAL\\mojo.7272.5156.600244375788013762","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GrShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\a08eedbb-1502-4353-adef-8e9e44843220.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\dc35e4f7-c316-43d8-947c-c24d18cbcedb.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GrShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GrShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GrShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GrShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GraphiteDawnCache\\index","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GraphiteDawnCache\\data_0","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GraphiteDawnCache\\data_1","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GraphiteDawnCache\\data_2","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\GraphiteDawnCache\\data_3","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Local State~RF40e1ae.TMP","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\ExtensionActivityEdge","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\ExtensionActivityComp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\ExtensionActivityComp-journal","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\optimization_guide_hint_cache_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\03da2357-28a4-4ca2-82ef-a2afad917924.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Preferences~RF413915.TMP","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\PreferredApps","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\adcef98a-a0bf-4ddc-895c-3c757401c307.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF40f824.TMP","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Network\\6b0f9722-d7ca-4c42-9b13-acda19f83a02.tmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"path":"%TEMP%\\tmpq_jfxzzv\\EBWebView\\Default\\Local Storage\\leveldb\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATE\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DEVICEACCESS\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\EDITION\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6556:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6556:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6556:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"SM0:6556:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:6556:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:6556:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5208:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:5208:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:5208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"SM0:5208:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5208:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:7272:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"SM0:7272:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7272:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7272:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:2792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3660:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"SM0:3660:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]},{"name":"Local\\SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695d88d2c6a9f8858d052580"}]}]}},"report_ids":{"sandbox_job_ids":["695d88d2c6a9f8858d052580"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 7d4b5dee59d7… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7d4b5dee59d7…. Threat score 85/100. 0/1 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 7d4b5dee59d7… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7d4b5dee59d7…. Threat score 85/100. 0/1 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7d4b5dee59d7ae364e5ce6d74917e1eff94cd000fcf62c6f22c8cc494f98db9a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 7d4b5dee59d7… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7d4b5dee59d7…. Threat score 85/100. 0/1 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8f","11",{}]]