24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 7f78a8d844a3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7f78a8d844a3…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74"],"about":{"@type":"SoftwareApplication","name":"DogKong_v8.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1edb,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "unknown compression method" (Source: "00000000-00002164.00000000.216797.044DA000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp") Found string "Failed to extract %s: decompression resulted in return code %d!" (Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found string "A file object providing transparent bzip2 (de)compression." (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "The compression level to use. Defaults to COMPRESSION_LEVEL_DEFAULT." (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "A dict object that contains advanced compression parameters." (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "Thread-safe at method level. For one-shot compression, use the compress()" (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "The dictionary can be used for compression or decompression, and can be shared" (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "Interface to the liblzma compression library." (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "classes for incremental (de)compression, and convenience functions for" (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "one-shot (de)compression." (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "compression" (Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string ">>> zf = ZipFile(data, 'w')" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "*level* is an optional int specifying the compression level to use," (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "*options* is an optional dict for advanced compression parameters." (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "See CompressionParameter and DecompressionParameter for the possible" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "*level* is an int specifying the compression level to use, defaulting to" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "*options* is a dict object that contains advanced compression" (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "For incremental compression, use a ZstdCompressor instead." (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "the appropriate compression extension (".gz", ".bz2", ".xz", or ".zst")." (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "the appropriate compression extension (".gz", ".bz2", ".xz" or ".Z")." (Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp")26:T18f8,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "DogKong_v8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DogKong_v8.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "DogKong_v8.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "DogKong_v8.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "DogKong_v8.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "DogKong_v8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "DogKong_v8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "DogKong_v8.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "DogKong_v8.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "DogKong_v8.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "BatchedWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")27:Tdf5,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "DogKong_v8.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "U|i:LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "LoadLibrary(name, load_flags) -> handle" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "FreeLibrary(handle) -> void" (Indicator: "FreeLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "O&:FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "Using cdll.LoadLibrary():" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp")28:Ta68,file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_SHA384.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_SHA512.pyd") file/memory contains long string with (Indicator: "RC2"; File: "_raw_arc2.pyd") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "DogKong_v8.exe") Found reference to "bCrypto\Hash\_SHA384.pyd" (Indicator: "SHA384"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found reference to "bCrypto\Hash\_SHA512.pyd" (Indicator: "SHA512"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found reference to "_hmac.HMAC" (Indicator: "HMAC"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found reference to "Crypto.Hash.SHA384" (Indicator: "SHA384"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to "Crypto.Hash.SHA512" (Indicator: "SHA512"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")29:T7ca,"DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM")2a:T29f1,Found XOR loop in file "VCRUNTIME140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 100676; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 186154; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 392603; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 626921; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 722841; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 53847; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 54151; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 54469; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 68842; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 75814; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 96124; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 110109; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 380326; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 380672; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 419506; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 478066; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 497212; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 518289; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 538921; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 681128; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 100796; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 140458; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 271864; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 354330; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 365679; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 477403; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 534189; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 631143; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 679498; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 725229; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 137587; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 280510; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 215115; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 275803; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 285069; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 9207; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 176574; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 171867; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 181133; code bytes = 8030 Found XOR loop in file "_cffi_backend.cp314-win_amd64.pyd" at offset 104457; code bytes = 30d0 Found XOR loop in file "_cffi_backend.cp314-win_amd64.pyd" at offset 108039; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3265; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15558; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15609; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15665; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17432; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54392; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54404; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55344; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55356; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56004; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56015; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56671; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56678; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57584; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57637; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57660; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75827; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89545; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90182; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 154046; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52847; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 126356; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 149339; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 158605; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 141330; code bytes = 30d0 Found XOR loop in file "_ctypes.pyd" at offset 28627; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 134590; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 129883; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 139149; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 11620; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 40119; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 80830; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 76123; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 85388; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 9475; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 80318; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 75611; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 84877; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 58972; code bytes = 30d0 Found XOR loop in file "_asyncio.pyd" at offset 4755; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 71614; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 66907; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 76172; code bytes = 8030 Found XOR loop in file "_ed448.pyd" at offset 41622; code bytes = 33c1 Found XOR loop in file "_ed448.pyd" at offset 61932; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 14915; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 62398; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 57691; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 66957; code bytes = 8030 Found XOR loop in file "_curve448.pyd" at offset 26454; code bytes = 33c1 Found XOR loop in file "_curve448.pyd" at offset 46764; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 3955; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 51134; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 46427; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 55692; code bytes = 8030 Found XOR loop in file "_raw_des.pyd" at offset 7884; code bytes = 33c1 Found XOR loop in file "_raw_des3.pyd" at offset 8076; code bytes = 33c1 Found XOR loop in file "_ffi.pyd" at offset 18104; code bytes = 30d0 Found XOR loop in file "_ffi.pyd" at offset 9168; code bytes = 33c1 Found XOR loop in file "_ffi.pyd" at offset 23011; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 2691; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 31678; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 26971; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 36237; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 4643; code bytes = 33c1 Found XOR loop in file "_queue.pyd" at offset 29630; code bytes = 33c1 Found XOR loop in file "_queue.pyd" at offset 14048; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 24923; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 34189; code bytes = 8030 Found XOR loop in file "_raw_aes.pyd" at offset 1412; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1415; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1769; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1975; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 2587; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 2873; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 3009; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 3538; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 4336; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 16716; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 7962; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 14630; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 19228; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 28644; code bytes = 8030 Found XOR loop in file "_modexp.pyd" at offset 28652; code bytes = 8030 Found XOR loop in file "_SHA384.pyd" at offset 16412; code bytes = 33c1 Found XOR loop in file "_SHA512.pyd" at offset 16524; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2069; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2235; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2372; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2572; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3086; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3168; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3801; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3848; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 4146; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 4226; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 7180; code bytes = 33c12b:T7c6,Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp")2c:T6c6,Found system information discovery API: "GetEnvironmentStringsW" in file "DogKong_v8.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "DogKong_v8.exe" Found system information discovery API: "GetMonitorInfoW" in file "DogKong_v8.exe" Found system information discovery API: "GetSystemInfo" in file "DogKong_v8.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00002164.00000000.216797.213F3000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002164.00000000.216797.213F3000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ" in "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStrings" in "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp"2d:T2c5b,"DogKong_v8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002252) "DogKong_v8.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002252) "DogKong_v8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000003d000000fd7f0000010000000000000008000000000000000200000000000000c0166e5acd02000009000000000000008032e9fafd7f0000b0986d5acd020000d0405e97e70000000000000000000000c0166e5acd020000080000000000000082868ffafd7f000001cff8fafd7f000010379c58cd020000010000000000000001000000fd7f000040946d5acd02000000768c5bcd02000040cbe9fafd7f000020000000000000005654065bcd020000d0405e97e700000009000000000000000000000000000000b0986d5acd0200008032e9fafd7f000008000000000000002d8d8ffafd7f0000c0166e5acd020000c0166e5acd02000001000000 (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000028955e97e7000000000000000000000000002a22fe7f000028955e97e700000036bbb52ffe7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000050d7b52ffe7f0000000000000000000028955e97e7000000000000000000000000000000000400bc0100000000000000527f412dfe7f00000100000000000000136f6504fe7f000000000000eb271c0000000000000400bc00004f04fe7f0000010000000000000028955e97e700000005706504fe7f0000070000000000000000000000000000000000000000000000c5412a22fe7f00000000000000000000f8696504fe7f000000000000 (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938222dfe7f000080000000000000000000000000000000f0bd3e5bcd0200001033b82ffe7f000000000000000000000000302efe7f000030905e97e700000010411f2dfe7f0000e0b3305bcd020000f08f5e97e7000000000000000000000000000000000000000100000000000000b8401f2dfe7f0000060000000000000001000000000000000000302efe7f00003b4d3e2dfe7f0000000000000000000028955e97e70000000000000000000000d02a422efe7f000010b3a82efe7f0000e8f81e2dfe7f000010b3a82efe7f0000d02a422efe7f00000d000000fe7f00000d00000000000000a0f6982efe7f0000f5873d2efe7f0000d02a422e (UID: 00000000-00002164) "DogKong_v8.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000060249e58cd02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a6e934ea4dcd00000000000000000000000000000000000000000000000000000000000000000000d05f265bcd0200000900000000000000103c9158cd020000a88e37fafd7f0000404dcb2ffe7f00000000000000000000341fb52ffe7f00000000000000000000b2c8131efe7f0000a88e37fafd7f0000010000000000000001000000 (UID: 00000000-00002164) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000db06fe7f0000e00c70977302000058ed4f53f7000000060000000000000031e4b52ffe7f00000000000000000000000000000000000030eb4f53f7000000000000000000000080ea4f53f70000001014c62ffe7f000000000000000000009013c62ffe7f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060beb62ffe7f00000802000000000000b08370977302000000eb4f53f7000000604d6f9773020000604d6f9773020000a083709773020000bf3170977302000004000000f7000000b029709773020000f385b52ffe7f0000b02970977302000008eb4f53f700000000000000 (UID: 00000000-00007836) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007836) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000db06fe7f0000702bfc1f99020000e8eb2f699c000000060000000000000031e4b52ffe7f000000000000000000000000000000000000c0e92f699c000000000000000000000010e92f699c0000001014c62ffe7f000000000000000000009013c62ffe7f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060beb62ffe7f00000802000000000000a02dfc1f9902000090e92f699c000000609efc1f99020000609efc1f99020000902dfc1f990200005f49fc1f99020000000000009c000000b045fc1f99020000f385b52ffe7f0000b045fc1f9902000098e92f699c00000000000000 (UID: 00000000-00005996) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "netsh.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "netsh.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938222dfe7f000080000000000000000000000000000000f0836a34d00200001033b82ffe7f000000000000000000000000302efe7f0000806f56e8fd00000010411f2dfe7f0000e0676934d0020000406f56e8fd000000000000000000000000000000000000000100000000000000b8401f2dfe7f0000000000000000000001000000000000000000302efe7f00003b4d3e2dfe7f00000000000000000000787456e8fd0000000000000000000000d02a422efe7f000010b3a82efe7f0000e8f81e2dfe7f000010b3a82efe7f0000d02a422efe7f00000d000000fe7f00000d00000000000000a0f6982efe7f0000f5873d2efe7f0000d02a422e (UID: 00000000-00003628) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a86756e8fd000000d06756e8fd00000074175a34d0020000000000000000000061d0b42ffe7f00000200000000000000306756e8fd000000306756e8fd0000000000000000000000fc6656e8fd000000f86656e8fd00000018000001fd7f0000806d56e8fd00000000000000b4040000517495180100000000206be8fd00000074175a34d002000020000000030000000000000000000000020000000300000002000000fd000000000000000000000000000000000000000000000000000000c06956e8fd000000606856e8fd00000065ccb42ffe7f0000106956e8fd0000000000000000000000c00c6234d0020000a86756e8fd000000d06756e8 (UID: 00000000-00003628)2e:T8a0,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DogKong_v8.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "DogKong_v8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp")2f:Tc30,"DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2 (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\Cipher (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\Hash (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\Math (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\Protocol (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\PublicKey (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\Crypto\Util (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_argon2_cffi_bindings (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\encoding (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\http1.0 (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\msgs (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\opt0.4 (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\Africa (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\America (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\America\Argentina (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\America\Indiana (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\America\Kentucky (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\America\North_Dakota (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\Antarctica (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\Arctic (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\Asia (UID: 00000000-00002252) "DogKong_v8.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000008cc2\_tcl_data\tzdata\Atlantic (UID: 00000000-00002252)30:T13c1,"DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002252) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002252) "DogKong_v8.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00002252) "DogKong_v8.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00002252) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\python314.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\python3 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_ctypes.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_bz2.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_lzma.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_zstd.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_socket.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_queue.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_wmi.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_hashlib.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_ssl.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_tkinter.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_argon2_cffi_bindings\_ffi.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_cffi_backend.cp314-win_amd64.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\Crypto\Hash\_RIPEMD160.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\unicodedata.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_decimal.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\_uuid.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\select.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\charset_normalizer\cd.cp314-win_amd64.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\charset_normalizer\md.cp314-win_amd64.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\lxml\etree.cp314-win_amd64.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000008cc2\lxml\_elementpath.cp314-win_amd64.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00002164) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003628) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003628) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003628)31:T59eb,"DogKong_v8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002252) "DogKong_v8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter VirtualAlloc2FromApp (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemoryEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetNumaProcessorNodeEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMaskEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetNumaProcessorNode (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_Free (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_SetInt (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStr (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStrList (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInitConfig_GetError (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter Py_InitializeFromInitConfig (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__zstd (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__wmi (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__tkinter (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CancelSynchronousIo (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__ffi (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__cffi_backend (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter ripemd160_init (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter ripemd160_destroy (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter ripemd160_update (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter ripemd160_digest (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__decimal (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit_cd (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit_md (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit_etree (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter PyInit__elementpath (UID: 00000000-00002164) "DogKong_v8.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002164) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007836) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005996) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005996) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005996) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005996) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005996) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005996) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GdiAlphaBlend (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GdiGradientFill (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter WinSqmAddToStream (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPointForPerMonitorDPI (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003628) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003628)32:T152a8,Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DeleteObject"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SelectObject"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FreeLibrary"; File: "DogKong_v8.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DeleteFileW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetLastError"; File: "DogKong_v8.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FlsAlloc"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RaiseException"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetLastError"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MulDiv"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "EncodePointer"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFileType"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FormatMessageW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "DogKong_v8.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "DogKong_v8.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "HeapAlloc"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WriteFile"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetOEMCP"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetErrorMode"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCPInfo"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateProcessW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CompareStringW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetStdHandle"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetTempPathW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "Sleep"; File: "DogKong_v8.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LocalFree"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "DogKong_v8.exe") Found reference to API (Indicator: "HeapSize"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "DogKong_v8.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "DogKong_v8.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FindNextFileW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LCMapStringW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CloseHandle"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TerminateProcess"; File: "DogKong_v8.exe") Found reference to API (Indicator: "Process32FirstW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FlsSetValue"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetStdHandle"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ExitProcess"; File: "DogKong_v8.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FlsGetValue"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "DogKong_v8.exe") Found reference to API (Indicator: "OpenProcess"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "K32EnumProcessModules"; File: "DogKong_v8.exe") Found reference to API (Indicator: "VirtualProtect"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FlsFree"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetProcAddress"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetACP"; File: "DogKong_v8.exe") Found reference to API (Indicator: "Process32NextW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ReadFile"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "DogKong_v8.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "FindClose"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateFileW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "HeapFree"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ReleaseDC"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "DogKong_v8.exe") Found reference to API (Indicator: "PeekMessageW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetCursorPos"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ShowWindow"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RegisterClassW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TranslateMessage"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MessageBoxA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DestroyWindow"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MessageBoxW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InvalidateRect"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetDC"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DestroyIcon"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetClientRect"; File: "DogKong_v8.exe") Found reference to API (Indicator: "MoveWindow"; File: "DogKong_v8.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CompareStringEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateDirectory"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TlsGetValue"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TlsSetValue"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TlsAlloc"; File: "DogKong_v8.exe") Found reference to API (Indicator: "TlsFree"; File: "DogKong_v8.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RtlUnwind"; File: "DogKong_v8.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertCloseStore"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertAddStoreToCollection"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertEnumCRLsInStore"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertFreeCRLContext"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CertOpenStore"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "DogKong_v8.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateThread"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SysFreeString"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SysStringLen"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "DogKong_v8.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "DogKong_v8.exe") Found reference to API (Indicator: "VerifyVersionInfoA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "UuidFromStringW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "UuidToStringW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RpcStringFreeW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getprotobyname"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getservbyname"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getsockopt"; File: "DogKong_v8.exe") Found reference to API (Indicator: "htons"; File: "DogKong_v8.exe") Found reference to API (Indicator: "recvfrom"; File: "DogKong_v8.exe") Found reference to API (Indicator: "inet_ntoa"; File: "DogKong_v8.exe") Found reference to API (Indicator: "closesocket"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ioctlsocket"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ntohs"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSASetLastError"; File: "DogKong_v8.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "DogKong_v8.exe") Found reference to API (Indicator: "inet_addr"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getsockname"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSAStartup"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getservbyport"; File: "DogKong_v8.exe") Found reference to API (Indicator: "gethostbyname"; File: "DogKong_v8.exe") Found reference to API (Indicator: "htonl"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSACleanup"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSAIoctl"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ntohl"; File: "DogKong_v8.exe") Found reference to API (Indicator: "getpeername"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateEventW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ResetEvent"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CancelIoEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateEventA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "DogKong_v8.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "DogKong_v8.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "DogKong_v8.exe") Found reference to API (Indicator: "UnregisterWait"; File: "DogKong_v8.exe") Found reference to API (Indicator: "SetEvent"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSAStringToAddressW"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WSASend"; File: "DogKong_v8.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "DogKong_v8.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "DogKong_v8.exe") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "SetDllDirectoryW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5AE20000.00000004.mdmp, 00000000-00002164.00000001.218716.5AE20000.00000004.mdmp, 00000000-00002164.00000002.220638.5AE20000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.FA748000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcessModules"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetLongPathName"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMapping"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "CopyFile2"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")33:T4cf,Found string "%WINDIR%\system32\cmd.exe /c "ver"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00002164-00000C47-3814425106") Found string "%WINDIR%\system32\cmd.exe /c "ver"" (Indicator: "cmd.exe /c"; Source: "00000000-00002164-00000C47-3814425106") Found string "%WINDIR%\system32\cmd.exe /c netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=1" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00002164-00000C47-5470420684") Found string "%WINDIR%\system32\cmd.exe /c netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=1" (Indicator: "cmd.exe /c"; Source: "00000000-00002164-00000C47-5470420684") Found string ":\WINDOWS\system32\cmd.exe /c netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1" (Indicator: "cmd.exe /c"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp")34:T8df,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "DogKong_v8.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "DogKong_v8.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "DogKong_v8.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "DogKong_v8.exe") Found reference to API "given, the return value of a call to GetLastError() is used." (Indicator: "GetLastError"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")35:T8c0,"VCRUNTIME140.dll" contains export function called "_CreateFrameInfo" at ordinal 1 "VCRUNTIME140.dll" contains export function called "_CxxThrowException" at ordinal 2 "VCRUNTIME140.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 3 "VCRUNTIME140.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 4 "VCRUNTIME140.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 5 "VCRUNTIME140.dll" contains export function called "__AdjustPointer" at ordinal 6 "VCRUNTIME140.dll" contains export function called "__BuildCatchObject" at ordinal 7 "VCRUNTIME140.dll" contains export function called "__BuildCatchObjectHelper" at ordinal 8 "VCRUNTIME140.dll" contains export function called "__C_specific_handler" at ordinal 9 "VCRUNTIME140.dll" contains export function called "__C_specific_handler_noexcept" at ordinal 10 "VCRUNTIME140.dll" contains export function called "__CxxDetectRethrow" at ordinal 11 "VCRUNTIME140.dll" contains export function called "__CxxExceptionFilter" at ordinal 12 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler" at ordinal 13 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler2" at ordinal 14 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler3" at ordinal 15 "VCRUNTIME140.dll" contains export function called "__CxxQueryExceptionSize" at ordinal 16 "VCRUNTIME140.dll" contains export function called "__CxxRegisterExceptionObject" at ordinal 17 "VCRUNTIME140.dll" contains export function called "__CxxUnregisterExceptionObject" at ordinal 18 "VCRUNTIME140.dll" contains export function called "__DestructExceptionObject" at ordinal 19 "VCRUNTIME140.dll" contains export function called "__FrameUnwindFilter" at ordinal 20 "VCRUNTIME140.dll" contains export function called "__GetPlatformExceptionInfo" at ordinal 21 "VCRUNTIME140.dll" contains export function called "__NLG_Dispatch2" at ordinal 22 "VCRUNTIME140.dll" contains export function called "__NLG_Return2" at ordinal 23 "VCRUNTIME140.dll" contains export function called "__RTCastToVoid" at ordinal 24 "VCRUNTIME140.dll" contains export function called "__RTDynamicCast" at ordinal 2536:T728,Process DogKong_v8.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2252:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2252:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "SM0:2252:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "Local\SM0:2252:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2164:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2164:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "Local\SM0:2164:304:WilStaging_02" Process DogKong_v8.exe created mutex with name "SM0:2164:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7836:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7836:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:7836:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:7836:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5996:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5996:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:5996:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:5996:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3628:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3628:304:WilStaging_02" Process netsh.exe created mutex with name "Local\SM0:3628:304:WilStaging_02" Process netsh.exe created mutex with name "SM0:3628:304:WilStaging_02"37:Tab3,Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "VCRUNTIME140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ec_ws.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_cffi_backend.cp314-win_amd64.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ctypes.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_bz2.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_socket.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_asyncio.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "_ed448.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_hashlib.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_curve448.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_overlapped.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_raw_des.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_raw_des3.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ffi.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_multiprocessing.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_queue.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")38:Td66,"DogKong_v8.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "_ec_ws.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_cffi_backend.cp314-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ed448.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_curve448.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_overlapped.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_des.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_des3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ffi.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_multiprocessing.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_queue.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_aes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT39:Tefb,"Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002164.00000000.216797.5A640000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002164.00000000.216797.5A640000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002164.00000000.216797.5B640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002164.00000000.216797.5B640000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002164.00000001.218716.5A640000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002164.00000001.218716.5A640000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002164.00000001.218716.5B640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002164.00000001.218716.5B640000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Time Zones" in Source: 00000000-00002164.00000001.218716.61260000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\TimeZoneInformation" in Source: 00000000-00002164.00000001.218716.61260000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002164.00000001.218716.61260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002164.00000001.218716.614D0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00002164.00000002.220638.1F113000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00002164.00000002.220638.1F113000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00002164.00000002.220638.1F113000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002164.00000002.220638.5A640000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002164.00000002.220638.5A640000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002164.00000002.220638.5B640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002164.00000002.220638.5B640000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Time Zones" in Source: 00000000-00002164.00000002.220638.61260000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\TimeZoneInformation" in Source: 00000000-00002164.00000002.220638.61260000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002164.00000002.220638.61260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002164.00000002.220638.614D0000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00002252.00000000.216236.89DE3000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002252.00000000.216236.CE640000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00002252.00000002.220075.89DE3000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00003628.00000000.217035.34670000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00003628.00000000.217035.F32EC000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00003628.00000000.217035.F32EC000.00000002.mdmp3a:T20c9,"DogKong_v8.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe06db0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "RPCRT4.DLL" at base 7ffe2ebf0000 "DogKong_v8.exe" loaded module "VCRUNTIME140.DLL" at base 7ffe235e0000 "DogKong_v8.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ffe221a0000 "DogKong_v8.exe" loaded module "NTDLL.DLL" at base 7ffe2fb30000 "DogKong_v8.exe" loaded module "KERNELBASE" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe2a580000 "DogKong_v8.exe" loaded module "KERNELBASE.DLL" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "KERNEL32.DLL" at base 7ffe2d990000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\PYTHON314.DLL" at base 7ffdfa8e0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\PYTHON3" at base 2cd5aab0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_CTYPES.PYD" at base 7ffe0b850000 "DogKong_v8.exe" loaded module "KERNEL32" at base 7ffe2d990000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_BZ2.PYD" at base 7ffe0b960000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_LZMA.PYD" at base 7ffe0b590000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_ZSTD.PYD" at base 7ffe06980000 "DogKong_v8.exe" loaded module "PSAPI" at base 7ffe2eb50000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe2d2f0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_SOCKET.PYD" at base 7ffe08180000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_QUEUE.PYD" at base 7ffe17660000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_WMI.PYD" at base 7ffe14e10000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_HASHLIB.PYD" at base 7ffe07300000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_SSL.PYD" at base 7ffe072d0000 "DogKong_v8.exe" loaded module "OLE32.DLL" at base 7ffe2dea0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe205c0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe1f480000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe1fa30000 "DogKong_v8.exe" loaded module "AMSI.DLL" at base 7ffe1f1f0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe22650000 "DogKong_v8.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffe1f0e0000 "DogKong_v8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe2d3a0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\63ODAL7I.DLL" at base 7ffe081e0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_TKINTER.PYD" at base 7ffe06960000 "DogKong_v8.exe" loaded module "SHCORE" at base 7ffe2efa0000 "DogKong_v8.exe" loaded module "SHELL32" at base 7ffe2e300000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_ARGON2_CFFI_BINDINGS\_FFI.PYD" at base 7ffe110f0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_CFFI_BACKEND.CP314-WIN_AMD64.PYD" at base 7ffe04390000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\CRYPTO\HASH\_RIPEMD160.PYD" at base 7ffe14dc0000 "DogKong_v8.exe" loaded module "UXTHEME.DLL" at base 7ffe2a580000 "DogKong_v8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe2bfa0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\UNICODEDATA.PYD" at base 7ffe04400000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe2c410000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_DECIMAL.PYD" at base 7ffe04130000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe23de0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\_UUID.PYD" at base 7ffe14260000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe25230000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\SELECT.PYD" at base 7ffe07090000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\CHARSET_NORMALIZER\CD.CP314-WIN_AMD64.PYD" at base 7ffdf9f80000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\CHARSET_NORMALIZER\MD.CP314-WIN_AMD64.PYD" at base 7ffe040f0000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\LXML\ETREE.CP314-WIN_AMD64.PYD" at base 7ffdf9b80000 "DogKong_v8.exe" loaded module "%TEMP%\_MEI000008CC2\LXML\_ELEMENTPATH.CP314-WIN_AMD64.PYD" at base 7ffe043d0000 "DogKong_v8.exe" loaded module "IPHLPAPI" at base 7ffe2bac0000 "DogKong_v8.exe" loaded module "COMCTL32.DLL" at base 7ffe13d50000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 2cd61010000 "DogKong_v8.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffe2ee30000 "DogKong_v8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffe2f540000 "DogKong_v8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffe2f540000 "DogKong_v8.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffe2eee0000 "DogKong_v8.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffe2dea0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe06db0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe2bfa0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe2d990000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe2fb30000 "cmd.exe" loaded module "KERNELBASE" at base 7ffe2d3a0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe06db0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffe2bfa0000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffe110f0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffe2ebf0000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffe040f0000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffe2f8b0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffe01790000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffe01720000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffe04380000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffe02730000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffdf9100000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffe040e0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffdf8ff0000 "netsh.exe" loaded module "NETPROFM.DLL" at base 7ffe285f0000 "netsh.exe" loaded module "NETSH.EXE" at base 7ff6f32e0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffdf8f80000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffdf8ed0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffdf8e50000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffdf8c70000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffdf8c30000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffe03f40000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffdf8bd0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffe02720000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffdf8b80000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffdf8b70000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffdf8b40000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffdf8ab0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffe2da80000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe2a580000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffe24d30000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffe2c510000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffe12210000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffe2d990000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe2d2f0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffdf8a90000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffe2e1200003b:Td10,"DogKong_v8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DogKong_v8.exe" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "_ec_ws.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ec_ws.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_cffi_backend.cp314-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_cffi_backend.cp314-win_amd64.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Linker" and name: "Linker" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Linker" and name: "Linker" "_asyncio.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_asyncio.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ed448.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ed448.pyd" was detected as "Microsoft Linker" and name: "Linker" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Linker" and name: "Linker" "_curve448.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_curve448.pyd" was detected as "Microsoft Linker" and name: "Linker" "_overlapped.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_overlapped.pyd" was detected as "Microsoft Linker" and name: "Linker" "_raw_des.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_raw_des.pyd" was detected as "Microsoft Linker" and name: "Linker" "_raw_des3.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_raw_des3.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ffi.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ffi.pyd" was detected as "Microsoft Linker" and name: "Linker" "_multiprocessing.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_multiprocessing.pyd" was detected as "Microsoft Linker" and name: "Linker" "_queue.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_queue.pyd" was detected as "Microsoft Linker" and name: "Linker" "_raw_aes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_raw_aes.pyd" was detected as "Microsoft Linker" and name: "Linker"3c:T62f,"DogKong_v8.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ec_ws.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ssl.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_cffi_backend.cp314-win_amd64.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_bz2.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_socket.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_asyncio.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ed448.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_hashlib.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_curve448.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_overlapped.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_raw_des.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_raw_des3.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ffi.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_multiprocessing.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_queue.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_raw_aes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"3d:T521,"DogKong_v8.exe" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named "fothk" "VCRUNTIME140_1.dll" has an executable section named ".text" "_ec_ws.pyd" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "_ssl.pyd" has an executable section named ".text" "_cffi_backend.cp314-win_amd64.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "_ctypes.pyd" has an executable section named ".text" "_bz2.pyd" has an executable section named ".text" "_socket.pyd" has an executable section named ".text" "_asyncio.pyd" has an executable section named ".text" "_ed448.pyd" has an executable section named ".text" "_hashlib.pyd" has an executable section named ".text" "_curve448.pyd" has an executable section named ".text" "_overlapped.pyd" has an executable section named ".text" "_raw_des.pyd" has an executable section named ".text" "_raw_des3.pyd" has an executable section named ".text" "_ffi.pyd" has an executable section named ".text" "_multiprocessing.pyd" has an executable section named ".text" "_queue.pyd" has an executable section named ".text" "_raw_aes.pyd" has an executable section named ".text"3e:T52d,"DogKong_v8.exe" has an writable section named ".data" "DogKong_v8.exe" has an writable section named ".fptable" "VCRUNTIME140.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "_ec_ws.pyd" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "_ssl.pyd" has an writable section named ".data" "_cffi_backend.cp314-win_amd64.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data" "_bz2.pyd" has an writable section named ".data" "_socket.pyd" has an writable section named ".data" "_asyncio.pyd" has an writable section named ".data" "_asyncio.pyd" has an writable section named "AsyncioD" "_ed448.pyd" has an writable section named ".data" "_hashlib.pyd" has an writable section named ".data" "_curve448.pyd" has an writable section named ".data" "_overlapped.pyd" has an writable section named ".data" "_raw_des.pyd" has an writable section named ".data" "_raw_des3.pyd" has an writable section named ".data" "_ffi.pyd" has an writable section named ".data" "_multiprocessing.pyd" has an writable section named ".data" "_queue.pyd" has an writable section named ".data" "_raw_aes.pyd" has an writable section named ".data"3f:T2eb6,"DogKong_v8.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000ea00,add rsp, 0x28,jmp 0x14000e5f0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000f000,test eax, eax,je 0x14000e7c9,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d60b], rcx,je 0x14000e7c9,cmp rcx, rax,je 0x14000e7d0,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d5f9], rcx,jne 0x14000e7b7,xor al, al,add rsp, 0x28,ret ,mov al, 1," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "_ec_ws.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018171,call 0x18001830c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001801c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xe7f],mov rcx, rbx,call qword ptr [rip + 0xe6e],call qword ptr [rip + 0xe78],mov rcx, rax," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800224e1,call 0x180022500,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180022398,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1baec],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18002259a," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002f65,call 0x180002f84,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002e1c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1e068],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000301e," "_cffi_backend.cp314-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001b175,call 0x18001b194,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001b02c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0xde58],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18001b22e," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013225,call 0x1800133c0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800130dc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3e0b],mov rcx, rbx,call qword ptr [rip + 0x3e0a],call qword ptr [rip + 0x3df4],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800079c5,call 0x180007b60,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000787c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc663],mov rcx, rbx,call qword ptr [rip + 0xc652],call qword ptr [rip + 0xc65c],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a825,call 0x18000a844,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a6dc,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x77a8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a8de," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002ef5,call 0x180003090,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002dac,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x612b],mov rcx, rbx,call qword ptr [rip + 0x611a],call qword ptr [rip + 0x6124],mov rcx, rax," "_asyncio.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001c85,call 0x180001e20,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001b3c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x739b],mov rcx, rbx,call qword ptr [rip + 0x739a],call qword ptr [rip + 0x7384],mov rcx, rax," "_ed448.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000fbe1,call 0x18000fd7c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000fa8c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x140f],mov rcx, rbx,call qword ptr [rip + 0x13fe],call qword ptr [rip + 0x1408],mov rcx, rax," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004435,call 0x1800045d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800042ec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2bd3],mov rcx, rbx,call qword ptr [rip + 0x2bc2],call qword ptr [rip + 0x2bcc],mov rcx, rax," "_curve448.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000c0a1,call 0x18000c23c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000bf4c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xf4f],mov rcx, rbx,call qword ptr [rip + 0xf3e],call qword ptr [rip + 0xf48],mov rcx, rax," "_overlapped.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001965,call 0x180001b00,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000181c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x46b3],mov rcx, rbx,call qword ptr [rip + 0x46a2],call qword ptr [rip + 0x46ac],mov rcx, rax," "_raw_des.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002a3d,call 0x180002a5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800028e8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0xb598],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180002af3," "_raw_des3.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002afd,call 0x180002b1c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800029a8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0xb4d8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180002bb3," "_ffi.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800063d5,call 0x180006570,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000628c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc4b],mov rcx, rbx,call qword ptr [rip + 0xc6a],call qword ptr [rip + 0xc34],mov rcx, rax," "_multiprocessing.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001475,call 0x180001610,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000132c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1bc3],mov rcx, rbx,call qword ptr [rip + 0x1b6a],call qword ptr [rip + 0x1bcc],mov rcx, rax," "_queue.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001c15,call 0x180001db0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001acc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x141b],mov rcx, rbx,call qword ptr [rip + 0x141a],call qword ptr [rip + 0x1404],mov rcx, rax," "_raw_aes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004b41,call 0x180004cdc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800049ec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x14af],mov rcx, rbx,call qword ptr [rip + 0x149e],call qword ptr [rip + 0x14a8],mov rcx, rax,"40:T461,"DogKong_v8.exe" has high imagebase "0x140000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "_ec_ws.pyd" has high imagebase "0x180000000" "_decimal.pyd" has high imagebase "0x180000000" "_ssl.pyd" has high imagebase "0x180000000" "_cffi_backend.cp314-win_amd64.pyd" has high imagebase "0x180000000" "_lzma.pyd" has high imagebase "0x180000000" "_ctypes.pyd" has high imagebase "0x180000000" "_bz2.pyd" has high imagebase "0x180000000" "_socket.pyd" has high imagebase "0x180000000" "_asyncio.pyd" has high imagebase "0x180000000" "_ed448.pyd" has high imagebase "0x180000000" "_hashlib.pyd" has high imagebase "0x180000000" "_curve448.pyd" has high imagebase "0x180000000" "_overlapped.pyd" has high imagebase "0x180000000" "_raw_des.pyd" has high imagebase "0x180000000" "_raw_des3.pyd" has high imagebase "0x180000000" "_ffi.pyd" has high imagebase "0x180000000" "_multiprocessing.pyd" has high imagebase "0x180000000" "_queue.pyd" has high imagebase "0x180000000" "_raw_aes.pyd" has high imagebase "0x180000000"41:T908,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "DogKong_v8.exe") Found reference to API "U|i:LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "LoadLibrary(name, load_flags) -> handle" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "Using cdll.LoadLibrary():" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp")42:T6e86,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140.dll]- [targetUID: 00000000-00002252] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002252] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00002252] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_decimal.pyd]- [targetUID: 00000000-00002252] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ssl.pyd]- [targetUID: 00000000-00002252] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00002252] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_lzma.pyd]- [targetUID: 00000000-00002252] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ctypes.pyd]- [targetUID: 00000000-00002252] "cp936.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp936.enc]- [targetUID: 00000000-00002252] "clock.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\clock.tcl]- [targetUID: 00000000-00002252] "cp949.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp949.enc]- [targetUID: 00000000-00002252] "cns11643.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cns11643.enc]- [targetUID: 00000000-00002252] "euc-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\euc-kr.enc]- [targetUID: 00000000-00002252] "ksc5601.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\ksc5601.enc]- [targetUID: 00000000-00002252] "big5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\big5.enc]- [targetUID: 00000000-00002252] "cp950.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp950.enc]- [targetUID: 00000000-00002252] "gb12345.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\gb12345.enc]- [targetUID: 00000000-00002252] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_bz2.pyd]- [targetUID: 00000000-00002252] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_socket.pyd]- [targetUID: 00000000-00002252] "gb2312.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\gb2312.enc]- [targetUID: 00000000-00002252] "gb2312-raw.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\gb2312-raw.enc]- [targetUID: 00000000-00002252] "euc-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\euc-jp.enc]- [targetUID: 00000000-00002252] "jis0208.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\jis0208.enc]- [targetUID: 00000000-00002252] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000008cc2\_asyncio.pyd]- [targetUID: 00000000-00002252] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00002252] "jis0212.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\jis0212.enc]- [targetUID: 00000000-00002252] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_hashlib.pyd]- [targetUID: 00000000-00002252] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00002252] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_overlapped.pyd]- [targetUID: 00000000-00002252] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00002252] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00002252] "cp932.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp932.enc]- [targetUID: 00000000-00002252] "macJapan.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macJapan.enc]- [targetUID: 00000000-00002252] "_ffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_argon2_cffi_bindings\_ffi.pyd]- [targetUID: 00000000-00002252] "shiftjis.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\shiftjis.enc]- [targetUID: 00000000-00002252] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_multiprocessing.pyd]- [targetUID: 00000000-00002252] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_queue.pyd]- [targetUID: 00000000-00002252] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00002252] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00002252] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00002252] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00002252] "init.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\init.tcl]- [targetUID: 00000000-00002252] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00002252] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00002252] "auto.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\auto.tcl]- [targetUID: 00000000-00002252] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00002252] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00002252] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00002252] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00002252] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00002252] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00002252] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00002252] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00002252] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00002252] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00002252] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00002252] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00002252] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00002252] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00002252] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00002252] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00002252] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00002252] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00002252] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00002252] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00002252] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00002252] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00002252] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00002252] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00002252] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00002252] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00002252] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00002252] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00002252] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00002252] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00002252] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00002252] "http.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\http1.0\http.tcl]- [targetUID: 00000000-00002252] "history.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\history.tcl]- [targetUID: 00000000-00002252] "bn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\bn.msg]- [targetUID: 00000000-00002252] "el.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\el.msg]- [targetUID: 00000000-00002252] "be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\be.msg]- [targetUID: 00000000-00002252] "ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ar.msg]- [targetUID: 00000000-00002252] "bg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\bg.msg]- [targetUID: 00000000-00002252] "ar_jo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ar_jo.msg]- [targetUID: 00000000-00002252] "ar_lb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ar_lb.msg]- [targetUID: 00000000-00002252] "ar_sy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ar_sy.msg]- [targetUID: 00000000-00002252] "fa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\fa.msg]- [targetUID: 00000000-00002252] "cs.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\cs.msg]- [targetUID: 00000000-00002252] "eo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\eo.msg]- [targetUID: 00000000-00002252] "de_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\de_be.msg]- [targetUID: 00000000-00002252] "de.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\de.msg]- [targetUID: 00000000-00002252] "et.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\et.msg]- [targetUID: 00000000-00002252] "es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es.msg]- [targetUID: 00000000-00002252] "da.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\da.msg]- [targetUID: 00000000-00002252] "ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ca.msg]- [targetUID: 00000000-00002252] "macCentEuro.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macCentEuro.enc]- [targetUID: 00000000-00002252] "macDingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macDingbats.enc]- [targetUID: 00000000-00002252] "macCroatian.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macCroatian.enc]- [targetUID: 00000000-00002252] "macCyrillic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macCyrillic.enc]- [targetUID: 00000000-00002252] "iso8859-16.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-16.enc]- [targetUID: 00000000-00002252] "macRomania.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macRomania.enc]- [targetUID: 00000000-00002252] "macIceland.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macIceland.enc]- [targetUID: 00000000-00002252] "iso8859-13.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-13.enc]- [targetUID: 00000000-00002252] "iso8859-10.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-10.enc]- [targetUID: 00000000-00002252] "iso8859-11.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-11.enc]- [targetUID: 00000000-00002252] "iso8859-14.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-14.enc]- [targetUID: 00000000-00002252] "macTurkish.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macTurkish.enc]- [targetUID: 00000000-00002252] "iso8859-15.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-15.enc]- [targetUID: 00000000-00002252] "macUkraine.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macUkraine.enc]- [targetUID: 00000000-00002252] "iso8859-1.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-1.enc]- [targetUID: 00000000-00002252] "iso8859-5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-5.enc]- [targetUID: 00000000-00002252] "iso8859-7.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-7.enc]- [targetUID: 00000000-00002252] "iso8859-9.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-9.enc]- [targetUID: 00000000-00002252] "iso8859-2.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-2.enc]- [targetUID: 00000000-00002252] "iso8859-8.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-8.enc]- [targetUID: 00000000-00002252] "iso8859-6.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-6.enc]- [targetUID: 00000000-00002252] "iso8859-4.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-4.enc]- [targetUID: 00000000-00002252] "iso8859-3.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso8859-3.enc]- [targetUID: 00000000-00002252] "macGreek.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macGreek.enc]- [targetUID: 00000000-00002252] "dingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\dingbats.enc]- [targetUID: 00000000-00002252] "macRoman.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macRoman.enc]- [targetUID: 00000000-00002252] "macThai.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\macThai.enc]- [targetUID: 00000000-00002252] "jis0201.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\jis0201.enc]- [targetUID: 00000000-00002252] "tis-620.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\tis-620.enc]- [targetUID: 00000000-00002252] "cp1255.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1255.enc]- [targetUID: 00000000-00002252] "cp1258.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1258.enc]- [targetUID: 00000000-00002252] "cp1251.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1251.enc]- [targetUID: 00000000-00002252] "cp1257.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1257.enc]- [targetUID: 00000000-00002252] "gb1988.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\gb1988.enc]- [targetUID: 00000000-00002252] "cp1253.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1253.enc]- [targetUID: 00000000-00002252] "cp1250.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1250.enc]- [targetUID: 00000000-00002252] "cp1252.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1252.enc]- [targetUID: 00000000-00002252] "koi8-u.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\koi8-u.enc]- [targetUID: 00000000-00002252] "cp1254.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1254.enc]- [targetUID: 00000000-00002252] "koi8-r.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\koi8-r.enc]- [targetUID: 00000000-00002252] "symbol.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\symbol.enc]- [targetUID: 00000000-00002252] "cp1256.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp1256.enc]- [targetUID: 00000000-00002252] "cp864.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp864.enc]- [targetUID: 00000000-00002252] "cp869.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp869.enc]- [targetUID: 00000000-00002252] "cp437.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp437.enc]- [targetUID: 00000000-00002252] "cp866.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp866.enc]- [targetUID: 00000000-00002252] "cp874.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp874.enc]- [targetUID: 00000000-00002252] "cp855.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp855.enc]- [targetUID: 00000000-00002252] "cp860.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp860.enc]- [targetUID: 00000000-00002252] "cp850.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp850.enc]- [targetUID: 00000000-00002252] "cp852.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp852.enc]- [targetUID: 00000000-00002252] "cp857.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp857.enc]- [targetUID: 00000000-00002252] "ascii.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\ascii.enc]- [targetUID: 00000000-00002252] "cp737.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp737.enc]- [targetUID: 00000000-00002252] "cp865.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp865.enc]- [targetUID: 00000000-00002252] "cp775.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp775.enc]- [targetUID: 00000000-00002252] "cp861.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp861.enc]- [targetUID: 00000000-00002252] "cp863.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp863.enc]- [targetUID: 00000000-00002252] "cp862.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\cp862.enc]- [targetUID: 00000000-00002252] "koi8-ru.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\koi8-ru.enc]- [targetUID: 00000000-00002252] "koi8-t.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\koi8-t.enc]- [targetUID: 00000000-00002252] "ebcdic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\ebcdic.enc]- [targetUID: 00000000-00002252] "af.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\af.msg]- [targetUID: 00000000-00002252] "eu.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\eu.msg]- [targetUID: 00000000-00002252] "de_at.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\de_at.msg]- [targetUID: 00000000-00002252] "pkgIndex.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\http1.0\pkgIndex.tcl]- [targetUID: 00000000-00002252] "en_hk.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_hk.msg]- [targetUID: 00000000-00002252] "en_ph.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_ph.msg]- [targetUID: 00000000-00002252] "en_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_in.msg]- [targetUID: 00000000-00002252] "en_be.msg" has type "Unknown"- [targetUID: 00000000-00002252] "en_au.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_au.msg]- [targetUID: 00000000-00002252] "en_nz.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_nz.msg]- [targetUID: 00000000-00002252] "en_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_ca.msg]- [targetUID: 00000000-00002252] "eu_es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\eu_es.msg]- [targetUID: 00000000-00002252] "en_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_ie.msg]- [targetUID: 00000000-00002252] "en_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_gb.msg]- [targetUID: 00000000-00002252] "bn_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\bn_in.msg]- [targetUID: 00000000-00002252] "ar_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\ar_in.msg]- [targetUID: 00000000-00002252] "es_ve.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_ve.msg]- [targetUID: 00000000-00002252] "es_pa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_pa.msg]- [targetUID: 00000000-00002252] "es_py.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_py.msg]- [targetUID: 00000000-00002252] "es_co.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_co.msg]- [targetUID: 00000000-00002252] "es_cr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_cr.msg]- [targetUID: 00000000-00002252] "af_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\af_za.msg]- [targetUID: 00000000-00002252] "es_mx.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_mx.msg]- [targetUID: 00000000-00002252] "es_pe.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_pe.msg]- [targetUID: 00000000-00002252] "es_hn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_hn.msg]- [targetUID: 00000000-00002252] "es_ni.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_ni.msg]- [targetUID: 00000000-00002252] "es_sv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_sv.msg]- [targetUID: 00000000-00002252] "en_zw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_zw.msg]- [targetUID: 00000000-00002252] "es_do.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_do.msg]- [targetUID: 00000000-00002252] "es_uy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_uy.msg]- [targetUID: 00000000-00002252] "en_bw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_bw.msg]- [targetUID: 00000000-00002252] "es_ec.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_ec.msg]- [targetUID: 00000000-00002252] "es_gt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_gt.msg]- [targetUID: 00000000-00002252] "es_cl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_cl.msg]- [targetUID: 00000000-00002252] "es_pr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_pr.msg]- [targetUID: 00000000-00002252] "es_bo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_bo.msg]- [targetUID: 00000000-00002252] "en_sg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_sg.msg]- [targetUID: 00000000-00002252] "en_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\en_za.msg]- [targetUID: 00000000-00002252] "es_ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\msgs\es_ar.msg]- [targetUID: 00000000-00002252] "iso2022.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso2022.enc]- [targetUID: 00000000-00002252] "iso2022-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso2022-jp.enc]- [targetUID: 00000000-00002252] "iso2022-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\iso2022-kr.enc]- [targetUID: 00000000-00002252] "euc-cn.enc" has type "Unknown"- Location: [%TEMP%\_MEI000008cc2\_tcl_data\encoding\euc-cn.enc]- [targetUID: 00000000-00002252]43:T67f,"DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "")44:Tc61,"DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DOGKONG_V8"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "")45:T516,"DogKong_v8.exe" trying to touch file "C:\DogKong_v8.exe.Local\" "DogKong_v8.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\COMCTL32.dll" "DogKong_v8.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "DogKong_v8.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "DogKong_v8.exe" trying to touch file "C:\Windows\System32\imm32.dll" "DogKong_v8.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "DogKong_v8.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "DogKong_v8.exe" trying to touch file "C:\FLTLIB.DLL" "DogKong_v8.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "DogKong_v8.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "DogKong_v8.exe" trying to touch file "C:\MSVCP140.dll" "DogKong_v8.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSVCP140.dll" "DogKong_v8.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "DogKong_v8.exe" trying to touch file "C:\VCRUNTIME140.dll" "DogKong_v8.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll" "DogKong_v8.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll"46:T4b8,"DogKong_v8.exe" trying to access non-existent file "C:\FLTLIB.DLL" "DogKong_v8.exe" trying to access non-existent file "C:\MSVCP140.dll" "DogKong_v8.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "DogKong_v8.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\VCRUNTIME140.dll" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\VCRUNTIME140_1.dll" "DogKong_v8.exe" trying to access non-existent file "C:\Users\aXYjLWy\AppData\Local\Temp\_MEI000008cc2\FLTLIB.DLL" "DogKong_v8.exe" trying to access non-existent file "C:\Users\aXYjLWy\AppData\Local\Temp\_MEI000008cc2\MSVCP140.dll" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\ucrtbase.dll" "DogKong_v8.exe" trying to access non-existent file "C:\Users\aXYjLWy\AppData\Local\Temp\_MEI000008cc2\VERSION.dll" "DogKong_v8.exe" trying to access non-existent file "C:\dogkong_miner.exe" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\dogkong_miner.exe"47:Tc9a,"DogKong_v8.exe" trying to access non-existent file "C:\DogKong_v8.exe.Local\" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_Salsa20.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_chacha20.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_pkcs1_decode.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_aes.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_aesni.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_arc2.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_blowfish.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cast.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cbc.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cfb.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ctr.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_des.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_des3.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ecb.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_eksblowfish.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ocb.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ofb.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_BLAKE2s.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD2.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD4.pyd" "DogKong_v8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD5.pyd"48:T59e,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "DogKong_v8.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "DogKong_v8.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")49:T115e,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "http.tcl") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "DogKong_v8.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "DogKong_v8.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "DogKong_v8.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "DogKong_v8.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "DogKong_v8.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "DogKong_v8.exe") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found reference to API "# How to send help() to stderr" (Indicator: " send "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000000.216797.5AE20000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AE20000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AE20000.00000004.mdmp") Found reference to API "This module allows you to spawn processes, connect to their" (Indicator: " connect "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found reference to API "As a special case, accept None and return type(None) instead. Also wrap strings" (Indicator: " accept "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found reference to API "Interact with process: Send data to stdin and close it." (Indicator: " send "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "threading shutdown instead of interpreter shutdown." (Indicator: " shutdown "; Source: "00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found reference to API "Raises ShutDown if the queue has been shut down and is empty," (Indicator: " shutdown "; Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp")4a:T1e75,Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "oj.sc" Heuristic match: "hx.aq" Heuristic match: "xl.gq" Heuristic match: "kp>.ai" Heuristic match: "/k.mr" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "www.memtest86.com" Pattern match: "http://$url" Heuristic match: "api.ipify.org" Heuristic match: "dogkong-seed2.duckdns.org" Heuristic match: "dogkong-seed1.duckdns.org" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000008cc2/tcl8/8.4/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000008cc2/tcl8/8.5/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000008cc2/tcl8/8.6/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000008cc2/tcl8/8.5/msgcat-1.6.1.tm" Heuristic match: "btcl8\8.4\platform-1.0.19.tm" Heuristic match: "btcl8\8.4\platform\shell-1.1.4.tm" Heuristic match: "btcl8\8.5\msgcat-1.6.1.tm" Heuristic match: "btcl8\8.5\tcltest-2.5.8.tm" Heuristic match: "btcl8\8.6\http-2.9.8.tm" Pattern match: "myimport.zip/mydirectory" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.metapathfinder.invalidate_caches" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.executionloader.get_filename" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.exec_module" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_code" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.is_package" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.pathentryfinder.find_spec" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_source" Heuristic match: "__init__.py" Pattern match: "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py#l679-l688" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.create_module" Heuristic match: "pythonpath=tools/peg_generator python3 -m pegen.keywordgen grammar/python.gram grammar/tokens lib/keyword.py" Heuristic match: "encodings\__init__.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.resourceloader.get_data" Heuristic match: ">>> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> path.name" Pattern match: "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#l24-l25" Pattern match: "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#l81-l97" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py#l11" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l422" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l312" Heuristic match: "copyright (c) 1999-2000, marc-andre lemburg; mailto:mal@lemburg.com" Heuristic match: "copyright (c) 2000-2010, egenix.com software gmbh; mailto:info@egenix.com" Heuristic match: "\__init__.py" Heuristic match: "encodings\_win_cp_codecs.py" Heuristic match: "encodings\aliases.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "52.py" Heuristic match: "struct.py" Heuristic match: "c:\struct.py" Heuristic match: "pyimod01_archive.py" Heuristic match: "c:\pyimod01_archive.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\ctypes\__init__.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\ctypes\_endian.py" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\importlib\_bootstrap_external.py" Heuristic match: "c:\pyimod02_importers.py" Heuristic match: "pyimod02_importers.py" Heuristic match: "pyimod03_ctypes.py" Heuristic match: "c:\pyimod03_ctypes.py" Heuristic match: "pyimod04_pywin32.py" Heuristic match: "c:\pyimod04_pywin32.py" Heuristic match: "pyiboot01_bootstrap.py" Heuristic match: "dateutil.tz" Heuristic match: "dateutil.tz.tz" Heuristic match: "glob.py" Heuristic match: "libm.so" Heuristic match: "ctypes\__init__.py" Heuristic match: "types.py" Heuristic match: "reprlib.py" Heuristic match: "ctypes\_endian.py" Heuristic match: "ctypes\util.py" Heuristic match: "pyi_rth_inspect.py" Pattern match: "tar.gz/tar.bz2/tar.xz/tar.zst" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\ctypes\util.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\shutil.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\fnmatch.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\lzma.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\bz2.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\posixpath.py" Heuristic match: "librpm.so" Heuristic match: "libcrypt.so" Heuristic match: "shutil.py" Heuristic match: "fnmatch.py" Heuristic match: "functools.py" Pattern match: "https://docs.python.org/3/howto/mro.html" Heuristic match: "collections\__init__.py" Heuristic match: "it__.py" Heuristic match: "keyword.py" Heuristic match: "operator.py" Heuristic match: "bz2.py" Heuristic match: "enum.py" Heuristic match: "copyreg.py" Heuristic match: "re\__init__.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\subprocess.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\ctypes\wintypes.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\ctypes\_layout.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\signal.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\threading.py" Heuristic match: "enum.name" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\compression\__init__.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\compression\_common\_streams.py" Heuristic match: "pc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\compression\_common\__init__.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\compression\zstd\__init__.py" Heuristic match: "c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\compression\zstd\_zstdfile.py" Heuristic match: "re\_compiler.py" Heuristic match: "t__.py" Heuristic match: "re\_parser.py" Heuristic match: "compression\_common\__init__.py" Heuristic match: "compression\_common\_streams.py" Heuristic match: "re\_constants.py" Heuristic match: "lzma.py" Heuristic match: "re\_casefix.py" Heuristic match: "bz2file.name" Heuristic match: "compression\__init__.py" Heuristic match: "lzmafile.name" Heuristic match: "zstdfile.name" Heuristic match: "compression\zstd\__init__.py" Heuristic match: "compression\zstd\_zstdfile.py" Heuristic match: "subprocess.py" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Pattern match: "https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz"4b:Ted50,Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://w.wiki/anrm>" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://w.wiki/anrs>" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://members.loria.fr/pzimmermann/papers/accuracy.pdf>" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/source-distribution-format/" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00002164.00000000.216797.5AE20000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000000.216797.5AF20000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000000.216797.5B3AE000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000000.216797.5B3AE000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\__future__.pyfor" - Source: "00000000-00002164.00000000.216797.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00002164.00000000.216797.5B420000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002164.00000000.216797.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymlc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\_distutils_hack\__init__.py0hp[distutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00002164.00000000.216797.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.p" - Source: "00000000-00002164.00000000.216797.5B530000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/50ez[0ez[" - Source: "00000000-00002164.00000000.216797.5B530000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00002164.00000000.216797.5B530000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00002164.00000000.216797.5B530000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000000.216797.5B640000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.context')>>>" - Source: "00000000-00002164.00000000.216797.5B640000.00000004.mdmp") Found URL "http://socks" - Source: "00000000-00002164.00000000.216797.5B640000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002164.00000000.216797.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002164.00000000.216797.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000000.216797.5B760000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlpgk[(nid=%r," - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.@to[given" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\setuptools\_distutils\log.pydistutils.log.log" - Source: "00000000-00002164.00000000.216797.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/discussions/5011distribution._skip_setupcfg_normalizationadd" - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_files0ynzdistribution._expand_patterns(x+y*i).conjugate()" - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00002164.00000000.216797.5BBE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptoolswarning._formatp\'[setuptools_enforce_deprecationpkl[0ceza]mzp\'[0-'[pkz[0-'[peez0cezsetuptools\command\__init__.pydeprecated..setuptools._distutils.commandsetuptools._distutils.commandsetuptools._distutils.command.bdistist.pyz_3jsetuptools\_distutils\command\bdist.pylist" - Source: "00000000-00002164.00000000.216797.5BCE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlstaticmodule.__getattr__glob_relative..strpath" - Source: "00000000-00002164.00000000.216797.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_pointsls\config@" - Source: "00000000-00002164.00000000.216797.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00002164.00000000.216797.5BCE0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00002164.00000000.216797.5BDE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/return" - Source: "00000000-00002164.00000000.216797.5C5E0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/wait" - Source: "00000000-00002164.00000000.216797.5C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)dogk-v2-mainnet*jesus357860301988setuptools$qu.frfc822_unescapegy6fy_read_field_from_msgstr" - Source: "00000000-00002164.00000000.216797.5C5E0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/pgez" - Source: "00000000-00002164.00000000.216797.5C5E0000.00000004.mdmp") Found URL "https://api.ipify.orghttps://ifconfig.me/iphttps://icanhazip.comdetect_public_ipaccidentacousticartefactattitudebachelorbroccolibusinesschampioncinnamoncongressconsiderconvincecupboarddaughterdecreasedescribedinosaurdisagreedisorderdocumentelectricelephantelevator;.b" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://w.wiki/anrs>" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://members.loria.fr/pzimmermann/papers/accuracy.pdf>" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/source-distribution-format/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00002164.00000001.218716.5AE20000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000001.218716.5AF20000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlarserclconstruct" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00002164.00000001.218716.5B3AE000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\__future__.pyfor" - Source: "00000000-00002164.00000001.218716.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00002164.00000001.218716.5B420000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002164.00000001.218716.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymlc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\_distutils_hack\__init__.py0hp[distutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00002164.00000001.218716.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.p" - Source: "00000000-00002164.00000001.218716.5B530000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/50ez[0ez[" - Source: "00000000-00002164.00000001.218716.5B530000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00002164.00000001.218716.5B530000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00002164.00000001.218716.5B530000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000001.218716.5B640000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.context')>>>" - Source: "00000000-00002164.00000001.218716.5B640000.00000004.mdmp") Found URL "http://socks" - Source: "00000000-00002164.00000001.218716.5B640000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002164.00000001.218716.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002164.00000001.218716.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000001.218716.5B760000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlpgk[(nid=%r," - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.@to[given" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\setuptools\_distutils\log.pydistutils.log.log" - Source: "00000000-00002164.00000001.218716.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/discussions/5011distribution._skip_setupcfg_normalizationadd" - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_files0ynzdistribution._expand_patterns(x+y*i).conjugate()" - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00002164.00000001.218716.5BBE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptoolswarning._formatp\'[setuptools_enforce_deprecationpkl[0ceza]mzp\'[0-'[pkz[0-'[peez0cezsetuptools\command\__init__.pydeprecated..setuptools._distutils.commandsetuptools._distutils.commandsetuptools._distutils.command.bdistist.pyz_3jsetuptools\_distutils\command\bdist.pylist" - Source: "00000000-00002164.00000001.218716.5BCE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlstaticmodule.__getattr__glob_relative..strpath" - Source: "00000000-00002164.00000001.218716.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_pointsls\config@" - Source: "00000000-00002164.00000001.218716.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00002164.00000001.218716.5BCE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm.xqv(" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "https://www.gnu.org/software/libc/manual/html_node/tz-variable.htmlppca" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "http://speleotrove.com/decimal/decarith.htmland" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/ieee_854-1987decimal" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp") Found URL "https://www.gnu.org/software/libc/manual/html_node/tz-variable.html.." - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://blog.ganssle.io/articles/2018/02/aware-datetime-arithmetic.htmlpa-adiuud5uud'uuv" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://blog.ganssle.io/articles/2018/02/aware-datetime-arithmetic.htmlinit__l@.'ap" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html>" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://www.iana.org/time-zones>" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://www.freebsd.org/cgi/man.cgi?query=zic&sektion=8>" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://www.egenix.com/products/python/mxbase/mxdatetime/>" - Source: "00000000-00002164.00000001.218716.5BF86000.00000004.mdmp") Found URL "https://www.verisign.com/cps" - Source: "00000000-00002164.00000001.218716.5C230000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crlp$'\p*'\p('\h&(z[0&'\uthority" - Source: "00000000-00002164.00000001.218716.5C230000.00000004.mdmp") Found URL "http://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://www.w3.org/2001/xmlschema]" - Source: "00000000-00002164.00000001.218716.5C230000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://www.egenix.com/products/python/mxbase/mxdatetime/>" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://192.168.1.254:80/upnp/igd.xml')>>>" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://schema.org/movie" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://www.unicode.org/reports/tr46/>" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://google.com/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://httpbin.org/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00002164.00000001.218716.5C307000.00000004.mdmp") Found URL "http://schema.org/movie" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "http://www.ascc.net/xml/schematron" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "http://192.168.1.254:80/upnp/igd.xml')>>>" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "https://lxml.de/element_classes.html" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "http://192.168.1.254:80/*.xml')>>>" - Source: "00000000-00002164.00000001.218716.5C40E000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/return" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/wait" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)dogk-v2-mainnet*jesus357860301988setuptools$qu.frfc822_unescapegy6fy_read_field_from_msgstr" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/pgez" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://api.ipify.orghttps://ifconfig.me/iphttps://icanhazip.comdetect_public_ipaccidentacousticartefactattitudebachelorbroccolibusinesschampioncinnamoncongressconsiderconvincecupboarddaughterdecreasedescribedinosaurdisagreedisorderdocumentelectricelephantelevator;.b" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://mensagem" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://dogkong.duckdns.org/dogkongcore.start_mining[menu]" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "https://dogkong.duckdns.org/search?q=dogkongcore.mostrar_notificacoesdogkongcore.limpar_notificacoes" - Source: "00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/__deprecated_private_func..deprecated_funcutil" - Source: "00000000-00002164.00000001.218716.5C6E0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002164.00000001.218716.5C6E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002164.00000001.218716.5C6E0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc5545_aix_linux_uuidstopnzz@_leavesformat" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc5545@&'a" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__annotate__headerparsingerror.__init__raised" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920@iwaptwa0uwapiwa0vwapvwa0wwapwwaw" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000001.218716.61260000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002164.00000001.218716.61390000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/32908(c" - Source: "00000000-00002164.00000001.218716.61390000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00002164.00000001.218716.61390000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000001.218716.61390000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "https://github.com/psf/requests/pull/6710" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "https://requests.readthedocs.iolist[tuple[_kt," - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "http://mountargs" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "https://session.__init__requests.adapterssession.__enter__session.__exit___t.uritype0;zamerged_cookiesprepare_requestsession.prepare_request_t.paramstype_t.datatype_t.headerstype_t.filestypebool" - Source: "00000000-00002164.00000001.218716.614D0000.00000004.mdmp") Found URL "https://0qwastreamed" - Source: "00000000-00002164.00000001.218716.615E0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00002164.00000001.218716.615E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/1999/rec-html401-19991224/frameset.dtd4.01strict-//w3c//dtd" - Source: "00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00002164.00000001.218716.FA890000.00000002.mdmp") Found URL "https://cffi.readthedocs.io/en/latest/using.html" - Source: "00000000-00002164.00000002.220638.043AC000.00000002.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002164.00000002.220638.04406000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\_argon2_cffi_bindings\_ffi.pyd:_argon2_cffi_bindings._ffi1+0)" - Source: "00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifprovider=default,fips=yes,input=der,structure=subjectpublickeyinfo0a'\8n5z8n5z8n5zc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\_cffi_backend.cp314-win_amd64.pyd:_cffi_backendperform" - Source: "00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://embeddedinn.wordpress.com/tutorials/upnp-device-architecture/*" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "http://upnp.org/specs/arch/upnp-arch-devicearchitecture-v1.1.pdfs+" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/salt_(cryptography).." - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/binary_prefix" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "http://google.com/" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "http://httpbin.org/" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://w.wiki/anrm>" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://w.wiki/anrs>" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://members.loria.fr/pzimmermann/papers/accuracy.pdf>" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/source-distribution-format/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00002164.00000002.220638.5AE20000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000002.220638.5AF20000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlarserclconstruct" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00002164.00000002.220638.5B3AE000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\__future__.pyfor" - Source: "00000000-00002164.00000002.220638.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00002164.00000002.220638.5B420000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002164.00000002.220638.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymlc:\users\axyjlwy\appdata\local\temp\_mei000008cc2\_distutils_hack\__init__.py0hp[distutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00002164.00000002.220638.5B420000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.p" - Source: "00000000-00002164.00000002.220638.5B530000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/50ez[0ez[" - Source: "00000000-00002164.00000002.220638.5B530000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00002164.00000002.220638.5B530000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00002164.00000002.220638.5B530000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002164.00000002.220638.5B640000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.context')>>>" - Source: "00000000-00002164.00000002.220638.5B640000.00000004.mdmp") Found URL "http://socks" - Source: "00000000-00002164.00000002.220638.5B640000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002164.00000002.220638.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002164.00000002.220638.5B760000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000002.220638.5B760000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlpgk[(nid=%r," - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/userguide/declarative_config.html" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.@to[given" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\axyjlwy\appdata\local\temp\_mei000008cc2\setuptools\_distutils\log.pydistutils.log.log" - Source: "00000000-00002164.00000002.220638.5B870000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/discussions/5011distribution._skip_setupcfg_normalizationadd" - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_files0ynzdistribution._expand_patterns(x+y*i).conjugate()" - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00002164.00000002.220638.5BBE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptoolswarning._formatp\'[setuptools_enforce_deprecationpkl[0cez@]mzp\'[0-'[pkz[0-'[peez0cezsetuptools\command\__init__.pydeprecated..setuptools._distutils.commandsetuptools._distutils.commandsetuptools._distutils.command.bdistist.pyz_3jsetuptools\_distutils\command\bdist.pylist" - Source: "00000000-00002164.00000002.220638.5BCE0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/_ambiguousmarker.messagesetuptools.config.pyprojecttomluserguide/declarative_config.htmlstaticmodule.__getattr__glob_relative..strpath" - Source: "00000000-00002164.00000002.220638.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/?v1h_configexpander._obtain_entry_pointsls\config@" - Source: "00000000-00002164.00000002.220638.5BCE0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00002164.00000002.220638.5BCE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm.xqv(" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "https://www.gnu.org/software/libc/manual/html_node/tz-variable.html@a" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "http://speleotrove.com/decimal/decarith.htmland" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/ieee_854-1987decimal" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found URL "https://www.gnu.org/software/libc/manual/html_node/tz-variable.html.." - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://blog.ganssle.io/articles/2018/02/aware-datetime-arithmetic.htmlpa-adiuud5uud'uuv" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://blog.ganssle.io/articles/2018/02/aware-datetime-arithmetic.htmlinit__l@.'ap" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html>" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://www.iana.org/time-zones>" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://www.freebsd.org/cgi/man.cgi?query=zic&sektion=8>" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://www.egenix.com/products/python/mxbase/mxdatetime/>" - Source: "00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found URL "https://www.verisign.com/cps" - Source: "00000000-00002164.00000002.220638.5C230000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crlp$'\p*'\p('\h&(z[0&'\uthority" - Source: "00000000-00002164.00000002.220638.5C230000.00000004.mdmp") Found URL "http://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://exslt.org/dates-and-timeshttp://www.w3.org/2001/xmlschema]" - Source: "00000000-00002164.00000002.220638.5C230000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://www.egenix.com/products/python/mxbase/mxdatetime/>" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://192.168.1.254:80/upnp/igd.xml')>>>" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://schema.org/movie" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://www.unicode.org/reports/tr46/>" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://google.com/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://httpbin.org/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00002164.00000002.220638.5C307000.00000004.mdmp") Found URL "http://schema.org/movie" - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "http://www.ascc.net/xml/schematron" - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "http://192.168.1.254:80/upnp/igd.xml')>>>" - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "https://lxml.de/element_classes.html" - Source: "00000000-00002164.00000002.220638.5C40E000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/return" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/wait" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)dogk-v2-mainnet*jesus357860301988setuptools$qu.frfc822_unescapegy6fy_read_field_from_msgstr" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/pgez" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://api.ipify.orghttps://ifconfig.me/iphttps://icanhazip.comdetect_public_ipaccidentacousticartefactattitudebachelorbroccolibusinesschampioncinnamoncongressconsiderconvincecupboarddaughterdecreasedescribedinosaurdisagreedisorderdocumentelectricelephantelevator;.b" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://mensagem" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://dogkong.duckdns.org/dogkongcore.start_mining[menu]" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "https://dogkong.duckdns.org/search?q=dogkongcore.mostrar_notificacoesdogkongcore.limpar_notificacoes" - Source: "00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/__deprecated_private_func..deprecated_funcutil" - Source: "00000000-00002164.00000002.220638.5C6E0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002164.00000002.220638.5C6E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002164.00000002.220638.5C6E0000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc5545_aix_linux_uuidstopnzz@_leavesformat" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc5545@&'a" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__annotate__headerparsingerror.__init__raised" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920@iwaptwa0uwapiwa0vwapvwa0wwapwwaw" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000002.220638.61260000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002164.00000002.220638.61390000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/32908(c" - Source: "00000000-00002164.00000002.220638.61390000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00002164.00000002.220638.61390000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000002.220638.61390000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "https://github.com/psf/requests/pull/6710" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "https://requests.readthedocs.iolist[tuple[_kt," - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "http://mountargs" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "https://session.__init__requests.adapterssession.__enter__session.__exit___t.uritype0;zamerged_cookiesprepare_requestsession.prepare_request_t.paramstype_t.datatype_t.headerstype_t.filestypebool" - Source: "00000000-00002164.00000002.220638.614D0000.00000004.mdmp") Found URL "https://0qwastreamed" - Source: "00000000-00002164.00000002.220638.615E0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00002164.00000002.220638.615E0000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00002164.00000002.220638.FA748000.00000002.mdmp") Found URL "http://www.zlib.net/varfileinfotranslationtcl/tk" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20public%20rsa%20timestamping%20ca%202020.crl0ym0k0i]http://www.microsoft.com/pkiops/certs/microsoft%20public%20rsa%20timestamping%20ca%202020.crt0_0]0q0a0?3http://www.microsoft.com/pkiops/docs/repository.htm0@36ndzv" - Source: "00000000-00002252.00000001.218158.CE640000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00002252.00000002.220075.89DE3000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00002252.00000002.220075.89DE3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002252.00000002.220075.89DE3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002252.00000002.220075.89DE3000.00000004.mdmp") Found URL "http://www.zlib.net/varfileinfotranslationtcl/tk" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20public%20rsa%20timestamping%20ca%202020.crl0ym0k0i]http://www.microsoft.com/pkiops/certs/microsoft%20public%20rsa%20timestamping%20ca%202020.crt0_0]0q0a0?3http://www.microsoft.com/pkiops/docs/repository.htm0@36ndzv" - Source: "00000000-00002252.00000002.220075.CE640000.00000004.mdmp")4c:T936,"DogKong_v8.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI000008cc2\*.* (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter argon2_cffi-25.1.0.dist-info (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter certifi (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter charset_normalizer (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter Crypto (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter dateutil (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter libcrypto-3.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter libffi-8.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter libssl-3.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter lxml (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter pyexpat.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter python3.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter python314.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter setuptools (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter tcl8 (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter tcl86t.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter tk86t.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter VCRUNTIME140_1.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter zlib1.dll (UID: 00000000-00002164) "DogKong_v8.exe" called "FindNextFileW" with parameter _argon2_cffi_bindings (UID: 00000000-00002164)4d:T1e8b,file/memory contains long string with (Indicator: "aes"; File: "_raw_aes.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_eksblowfish.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_blowfish.pyd") file/memory contains long string with (Indicator: "aes"; File: "_raw_aesni.pyd") file/memory contains long string with (Indicator: "chacha"; File: "_chacha20.pyd") file/memory contains long string with (Indicator: "aes"; File: "_cpuid_c.pyd") Found string "bCrypto\Cipher\_chacha20.pyd" (Indicator: "chacha"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_aes.pyd" (Indicator: "aes"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_aesni.pyd" (Indicator: "aes"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_blowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "bCrypto\Cipher\_raw_eksblowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.FA748000.00000002.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5BFF8000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5BFF8000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp") Found string "C:\Users\aXYjLWy\AppData\Local\Temp\_MEI000008cc2\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000000.216797.5AF20000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AF20000.00000004.mdmp, 00000000-00002164.00000001.218716.5BF86000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AF20000.00000004.mdmp, 00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found string "aesZ" (Indicator: "aes"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp") Found string "path_name -- filesystem location of a Python script, zipfile," (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string ">>> zf = ZipFile(data, 'w')" (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found string "Path accepts the zipfile object itself or a filename" (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found string "resolve to the zipfile." (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found string "If the zipfile has no filename, such attributes are not" (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5ABF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5ABF0000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp")4e:T44c,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "DogKong_v8.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "DogKong_v8.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "DogKong_v8.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp")4f:T1ab2,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "DogKong_v8.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "DogKong_v8.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "DogKong_v8.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "DogKong_v8.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "DogKong_v8.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "DogKong_v8.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "DogKong_v8.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "DogKong_v8.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "DogKong_v8.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.04115000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.F9F97000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.FA748000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "EnumProcessModules failed:" (Indicator: "EnumProcessModules"; Source: "00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp")50:T66c,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "DogKong_v8.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "DogKong_v8.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "DogKong_v8.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "DogKong_v8.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "DogKong_v8.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp")51:T58d,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp") Found string "where the top-level Distutils __inst__.py file lives)" (Indicator: "where "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp")52:T493,Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "DogKong_v8.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "DogKong_v8.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")53:Td38,Found string "\Device\HarddiskVolume3\DogKong_v8.exe" (Indicator: "\Device\"; Source: "00000000-00002252-00000BC0-2375339981") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00002164-00000BC0-2377236729") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00007836-00000BC0-2377354493") Found string "\Device\HarddiskVolume3\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00005996-00000BC0-2379064194") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "\Device\HarddiskVolume3\DogKong_v8.exe" (Indicator: "\Device\"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000000.216797.5A350000.00000004.mdmp, 00000000-00002164.00000000.216797.5BDE0000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.5A350000.00000004.mdmp, 00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.5A350000.00000004.mdmp, 00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000000.216797.5A350000.00000004.mdmp, 00000000-00002164.00000000.216797.5BDE0000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.5A350000.00000004.mdmp, 00000000-00002164.00000001.218716.5BDE0000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.5A350000.00000004.mdmp, 00000000-00002164.00000002.220638.5BDE0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5BF86000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5BF86000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5BF86000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5BF86000.00000004.mdmp")54:Tada,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "DogKong_v8.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "DogKong_v8.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "DogKong_v8.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.043ED000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.072DE000.00000002.mdmp, 00000000-00002164.00000001.218716.07307000.00000002.mdmp, 00000000-00002164.00000001.218716.08189000.00000002.mdmp, 00000000-00002164.00000001.218716.0B5A7000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.110F7000.00000002.mdmp, 00000000-00002164.00000001.218716.14263000.00000002.mdmp, 00000000-00002164.00000001.218716.14DC3000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.17663000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.0415E000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04406000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp, 00000000-00002164.00000002.220638.069EA000.00000002.mdmp, 00000000-00002164.00000002.220638.07093000.00000002.mdmp, 00000000-00002164.00000002.220638.0B96E000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp")55:Ta00,"DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\DOGKONG_V8.EXE"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "DogKong_v8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")56:T1118,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140.dll]- [targetUID: 00000000-00002252] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002252] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00002252] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_decimal.pyd]- [targetUID: 00000000-00002252] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ssl.pyd]- [targetUID: 00000000-00002252] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00002252] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_lzma.pyd]- [targetUID: 00000000-00002252] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ctypes.pyd]- [targetUID: 00000000-00002252] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_bz2.pyd]- [targetUID: 00000000-00002252] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_socket.pyd]- [targetUID: 00000000-00002252] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000008cc2\_asyncio.pyd]- [targetUID: 00000000-00002252] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00002252] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_hashlib.pyd]- [targetUID: 00000000-00002252] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00002252] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_overlapped.pyd]- [targetUID: 00000000-00002252] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00002252] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00002252] "_ffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_argon2_cffi_bindings\_ffi.pyd]- [targetUID: 00000000-00002252] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_multiprocessing.pyd]- [targetUID: 00000000-00002252] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_queue.pyd]- [targetUID: 00000000-00002252] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00002252] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00002252] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00002252] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00002252] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00002252]57:T27c2,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140.dll]- [targetUID: 00000000-00002252] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002252] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00002252] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_decimal.pyd]- [targetUID: 00000000-00002252] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ssl.pyd]- [targetUID: 00000000-00002252] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00002252] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_lzma.pyd]- [targetUID: 00000000-00002252] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_ctypes.pyd]- [targetUID: 00000000-00002252] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_bz2.pyd]- [targetUID: 00000000-00002252] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_socket.pyd]- [targetUID: 00000000-00002252] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000008cc2\_asyncio.pyd]- [targetUID: 00000000-00002252] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ed448.pyd]- [targetUID: 00000000-00002252] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_hashlib.pyd]- [targetUID: 00000000-00002252] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_curve448.pyd]- [targetUID: 00000000-00002252] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_overlapped.pyd]- [targetUID: 00000000-00002252] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des.pyd]- [targetUID: 00000000-00002252] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00002252] "_ffi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_argon2_cffi_bindings\_ffi.pyd]- [targetUID: 00000000-00002252] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_multiprocessing.pyd]- [targetUID: 00000000-00002252] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\_queue.pyd]- [targetUID: 00000000-00002252] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00002252] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Math\_modexp.pyd]- [targetUID: 00000000-00002252] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA384.pyd]- [targetUID: 00000000-00002252] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA512.pyd]- [targetUID: 00000000-00002252] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00002252] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00002252] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA224.pyd]- [targetUID: 00000000-00002252] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA256.pyd]- [targetUID: 00000000-00002252] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00002252] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00002252] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00002252] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00002252] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_SHA1.pyd]- [targetUID: 00000000-00002252] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD5.pyd]- [targetUID: 00000000-00002252] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_keccak.pyd]- [targetUID: 00000000-00002252] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00002252] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00002252] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00002252] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD2.pyd]- [targetUID: 00000000-00002252] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00002252] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00002252] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00002252] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_poly1305.pyd]- [targetUID: 00000000-00002252] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_MD4.pyd]- [targetUID: 00000000-00002252] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00002252] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_chacha20.pyd]- [targetUID: 00000000-00002252] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00002252] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00002252] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00002252] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00002252] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Protocol\_scrypt.pyd]- [targetUID: 00000000-00002252] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00002252] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00002252] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_ARC4.pyd]- [targetUID: 00000000-00002252] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Util\_cpuid_c.pyd]- [targetUID: 00000000-00002252] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00002252] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000008cc2\Crypto\Util\_strxor.pyd]- [targetUID: 00000000-00002252]58:T5c9d,"DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\Crypto\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\VCRUNTIME140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_argon2_cffi_bindings\_ffi.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_asyncio.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_cffi_backend.cp314-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_multiprocessing.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_overlapped.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DogKong_v8.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000008cc2\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...59:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macIceland.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-13.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-10.enc" which has been seen in the context of ransomware (Indicator: .ENC)5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791115481272,"unified_at":"2026-10-04T12:04:41.272Z","metadata":{"hashes":{"sha256":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","sha1":"6ae03f37f0ae0bdc7cf340c93c203afcb3eb5745","md5":"5b36374f3dac86b71d34e0bf2c8b42b1","sha512":"d9aafb1615891089541cebe93dc0ca6cf2e048f6a89bfee5d731e8366d12ca183daba973431e276b5cbc0c5211ce4a8e6e01aaafd2ff2371595041872dc0be80","ssdeep":"393216:Ud3q0HFD0U1bxnWuxWd6vSqpMaNvV3sB1JeXmhIvrLmO+YTzDYe:Ud3qAp1bFdCrGSB1JamuDyPYXke","ssdeep_chunks":["393216:Ud3q0HF","393216:d3q0HFD","393216:3q0HFD0","393216:q0HFD0U","393216:0HFD0U1","393216:HFD0U1b","393216:FD0U1bx","393216:D0U1bxn","393216:0U1bxnW","393216:U1bxnWu","393216:1bxnWux","393216:bxnWuxW","393216:xnWuxWd","393216:nWuxWd6","393216:WuxWd6v","393216:uxWd6vS","393216:xWd6vSq","393216:Wd6vSqp","393216:d6vSqpM","393216:6vSqpMa","393216:vSqpMaN","393216:SqpMaNv","393216:qpMaNvV","393216:pMaNvV3","393216:MaNvV3s","393216:aNvV3sB","393216:NvV3sB1","393216:vV3sB1J","393216:V3sB1Je","393216:3sB1JeX","393216:sB1JeXm","393216:B1JeXmh","393216:1JeXmhI","393216:JeXmhIv","393216:eXmhIvr","393216:XmhIvrL","393216:mhIvrLm","393216:hIvrLmO","393216:IvrLmO+","393216:vrLmO+Y","393216:rLmO+YT","393216:LmO+YTz","393216:mO+YTzD","393216:O+YTzDY","393216:+YTzDYe","786432:Ud3q0HF","786432:d3q0HFD","786432:3q0HFD0","786432:q0HFD0U","786432:0HFD0U1","786432:HFD0U1b","786432:FD0U1bx","786432:D0U1bxn","786432:0U1bxnW","786432:U1bxnWu","786432:1bxnWux","786432:bxnWuxW","786432:xnWuxWd","786432:nWuxWd6","786432:WuxWd6v","786432:uxWd6vS","786432:xWd6vSq","786432:Wd6vSqp","786432:d6vSqpM","786432:6vSqpMa","786432:vSqpMaN","786432:SqpMaNv","786432:qpMaNvV","786432:pMaNvV3","786432:MaNvV3s","786432:aNvV3sB","786432:NvV3sB1","786432:vV3sB1J","786432:V3sB1Je","786432:3sB1JeX","786432:sB1JeXm","786432:B1JeXmh","786432:1JeXmhI","786432:JeXmhIv","786432:eXmhIvr","786432:XmhIvrL","786432:mhIvrLm","786432:hIvrLmO","786432:IvrLmO+","786432:vrLmO+Y","786432:rLmO+YT","786432:LmO+YTz","786432:mO+YTzD","786432:O+YTzDY","786432:+YTzDYe","393216:Ud3qAp1","393216:d3qAp1b","393216:3qAp1bF","393216:qAp1bFd","393216:Ap1bFdC","393216:p1bFdCr","393216:1bFdCrG","393216:bFdCrGS","393216:FdCrGSB","393216:dCrGSB1","393216:CrGSB1J","393216:rGSB1Ja","393216:GSB1Jam","393216:SB1Jamu","393216:B1JamuD","393216:1JamuDy","393216:JamuDyP","393216:amuDyPY","393216:muDyPYX","393216:uDyPYXk","393216:DyPYXke"],"imphash":"e3e80a143805ea18936c8f612e25d363"},"file_info":{"file_name":"DogKong_v8.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":20760785,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791115034000,"last_seen":1791115034000,"last_multi_scan":1791115034000},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":184,"suspicious_count":16,"malicious_count":4,"total":204},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Blank.Script.2228","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"malicious","value":"Contacts multiple hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Contacts Dynamic DNS (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"DogKong_v8.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"DogKong_v8.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.177E6000.00000002.mdmp\")\n Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"DogKong_v8.exe\" called \"FindResourceW\" with parameter \"140728801311264\" - (UID: 00000000-00002164)\n \"netsh.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"DogKong_v8.exe\" called \"LoadResource with parameter {'hModule': '140728800116736', 'hResInfo': '140728801598320'}\" (UID: 00000000-00002164)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"DogKong_v8.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002164.00000001.218716.5AAB0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found string - \\.\\S+); Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"DogKong_v8.exe\" renamed original file\"C:\\dogk_data_v2\\wallet.json.tmp\" to \"C:\\dogk_data_v2\\wallet.json\"\n \"DogKong_v8.exe\" renamed original file\"C:\\dogk_data_v2\\seeds.json.tmp\" to \"C:\\dogk_data_v2\\seeds.json\"\n \"DogKong_v8.exe\" renamed original file\"C:\\dogk_data_v2\\peers.json.tmp\" to \"C:\\dogk_data_v2\\peers.json\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"DogKong_v8.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"DogKong_v8.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"DogKong_v8.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DogKong_v8.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertAddStoreToCollection\" (Indicator: \"CertAddStoreToCollection\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertEnumCRLsInStore\" (Indicator: \"CertEnumCRLsInStore\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertGetEnhancedKeyUsage\" (Indicator: \"CertGetEnhancedKeyUsage\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertFreeCRLContext\" (Indicator: \"CertFreeCRLContext\"; File: \"DogKong_v8.exe\")\n Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.58900000.00000004.mdmp, 00000000-00002164.00000002.220638.58900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Encoding\" in header \"GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.14Connection: close\"\n Contains base64 string in header \"identityHost\" in header \"GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.14Connection: close\"\n Contains base64 string in header \"urllib/3\" in header \"GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.14Connection: close\"\n Contains base64 string in header \"14Connection\" in header \"GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.14Connection: close\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003628-00000C2C-2379631492\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003628-00000C2C-2379631492\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"DogKong_v8.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"DogKong_v8.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"DogKong_v8.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"DogKong_v8.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"DogKong_v8.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"DogKong_v8.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002164)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"DogKong_v8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002252)\n \"DogKong_v8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002164)\n \"DogKong_v8.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002164)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"DogKong_v8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002252)\n \"DogKong_v8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002164)\n \"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007836)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DogKong_v8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002252)\n \"DogKong_v8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002164)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007836)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005996)\n \"netsh.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"DogKong_v8.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002164)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: DogKong_v8.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00002164-00000C47-3814425106","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; File: \"DogKong_v8.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"DogKong_v8.exe\")\n Found reference to API \"VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; File: \"DogKong_v8.exe\")\n Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"DogKong_v8.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"DogKong_v8.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"netsh.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003628-00000C17-2379865525","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DogKong_v8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"DogKong_v8.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"DogKong_v8.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8\"; Key: \"BLOB\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"DogKong_v8.exe\" called \"CreateProcessW\" with parameter \"\"C:\\DogKong_v8.exe\"\" - (UID: 00000000-00002252)\n \"DogKong_v8.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00002164)\n \"DogKong_v8.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=1\" - (UID: 00000000-00002164)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555\" - (UID: 00000000-00005996)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"DogKong_v8.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002164)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.74.152:443\"\n \"147.15.48.39:18555\"\n \"177.202.50.185:18555\"\n \"191.247.146.103:18555\"\n \"190.213.231.49:18555\"\n \"188.163.102.106:18555\"\n \"85.102.19.250:18555\"\n \"167.234.244.29:18555\"\n \"177.202.28.120:18555\"\n \"177.202.50.57:18555\"\n \"69.173.206.211:18555\"\n \"162.35.99.85:18555\"\n \"177.86.4.1:18555\"\n \"95.26.206.250:18555\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\"), \"Insert a simple entry into the list of warnings filters (at the front).\" (Source: 00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp, Indicator: \"insert a simple entry into the list of warnings filters (at the front).\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$33","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"DogKong_v8.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"DogKong_v8.exe\")\n Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DogKong_v8.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002164.00000000.216797.5AAF0000.00000004.mdmp, 00000000-00002164.00000000.216797.5B870000.00000004.mdmp, 00000000-00002164.00000001.218716.5AAF0000.00000004.mdmp, 00000000-00002164.00000002.220638.5AAF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00002164.00000000.216797.5A640000.00000004.mdmp\n 00000000-00002164.00000001.218716.5A640000.00000004.mdmp\n 00000000-00002164.00000002.220638.5A640000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00002164.00000000.216797.5A640000.00000004.mdmp\n 00000000-00002164.00000001.218716.5A640000.00000004.mdmp\n 00000000-00002164.00000002.220638.5A640000.00000004.mdmp\n \"Y\\USER\\S-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00002164.00000000.216797.5ABF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$37","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$38","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"info@egenix.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"nadeem.vawda@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET / HTTP/1.1\nAccept-Encoding: identity\nHost: api.ipify.org\nUser-Agent: Python-urllib/3.14\nConnection: close\" Response ==> HTTP/1.1 200 OK\nDate: Sun\n 04 Oct 2026 11:58:21 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: close\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: a45403a7de7f888e-SJC with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 2E050000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"DogKong_v8.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1F1F0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"DogKong_v8.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2C830000\n \"DogKong_v8.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2D2F0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2C830000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2D2F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DogKong_v8.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2EBF0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2EBF0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2EBF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042612dfe7f0000@ntdll.dll\"\n \"22002300000000004042612dfe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3b","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"DogKong_v8.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"DogKong_v8.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"DogKong_v8.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"DogKong_v8.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"DogKong_v8.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$3c","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$3d","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3e","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$40","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00002164-00000BC0-2377236729]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00002164-00000BC0-2377238478]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00002164-00000C47-3814425106]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=1\" [Source: 00000000-00002164-00000C47-5470420684]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00007836-00000BC0-2377354493]\n Observed system executable string:\"%WINDIR%\\system32\\netsh.exe\" [Source: 00000000-00005996-00000C47-235567332]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\netsh.exe\" [Source: 00000000-00005996-00000BC0-2379064194]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DogKong_v8.exe\" (UID: 00000000-00002164) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\DogKong_v8.exe\", USERDNSDOMAIN=\"lARYmB6nywFPs2t\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI000008cc2\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"DogKong_v8.exe\" (UID: 00000000-00002164) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00007836) was launched with modified environment variables: \"_PYI_PARENT_PROCESS_LEVEL\"\n Process \"cmd.exe\" (UID: 00000000-00005996) was launched with new environment variables: \"TCL_LIBRARY=\"%TEMP%\\_MEI000008cc2\\_tcl_data\", TK_LIBRARY=\"%TEMP%\\_MEI000008cc2\\_tk_data\"\"\n Process \"netsh.exe\" (UID: 00000000-00003628) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"\n \"dogkong-seed2.duckdns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"DogKong_v8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"DogKong_v8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00002164-00000C2B-2377135481]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DogKong_v8.exe\" (UID: 00000000-00002164)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00007836)\n Spawned process \"cmd.exe\" with commandline \"/c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in ...\" (UID: 00000000-00005996)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in a ...\" (UID: 00000000-00003628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DogKong_v8.exe\" (UID: 00000000-00002164)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00007836)\n Spawned process \"cmd.exe\" with commandline \"/c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in ...\" (UID: 00000000-00005996)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in a ...\" (UID: 00000000-00003628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 56:5E:58:66:08:14:37:CD:B8:B5:82:D8:8F:94:96:06:7D:90:65:7B; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"DogKong_v8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_ARC4.pyd\"\n \"DogKong_v8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"DogKong_v8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_chacha20.pyd\"\n \"DogKong_v8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"DogKong_v8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_raw_aes.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00002164.00000000.216797.1F129000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"VCRUNTIME140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%TEMP%\\_MEI000008cc2\\VCRUNTIME140.dll]- [targetUID: 00000000-00002252]\n \"VCRUNTIME140_1.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- Location: [%TEMP%\\_MEI000008cc2\\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002252]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"DogKong_v8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_ARC4.pyd\"\n \"DogKong_v8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_Salsa20.pyd\"\n \"DogKong_v8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_chacha20.pyd\"\n \"DogKong_v8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_pkcs1_decode.pyd\"\n \"DogKong_v8.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000008cc2\\Crypto\\Cipher\\_raw_aes.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"DogKong_v8.exe\" queries basic process information of the \"C:\\DogKong_v8.exe\" (UID: 2252)\n \"DogKong_v8.exe\" queries basic process information of the \"C:\\DogKong_v8.exe\" (UID: 2164)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 7836)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 5996)\n \"netsh.exe\" queries basic process information of the \"C:\\Windows\\System32\\netsh.exe\" (UID: 3628)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"DogKong_v8.exe\" reads file \"c:\\dogkong_v8.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"DogKong_v8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000008cc2\\crypto\\cipher\\_arc4.pyd\"\n \"DogKong_v8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000008cc2\\crypto\\cipher\\_salsa20.pyd\"\n \"DogKong_v8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000008cc2\\crypto\\cipher\\_chacha20.pyd\"\n \"DogKong_v8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000008cc2\\crypto\\cipher\\_pkcs1_decode.pyd\"\n \"DogKong_v8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000008cc2\\crypto\\cipher\\_raw_aes.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contacts Dynamic DNS (possible C&C communication)","description":"\"dogkong-seed2.duckdns.org\"","origin":"Network Traffic","mitre_attack_id":"T1102","relevance":1,"id":"network-52","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555\" (UID: 00000000-00003628)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"b_tcl_data\\msgs\\es_mx.msg\" [Source: 00000000-00002164.00000000.216797.58900000.00000004.mdmp\n 00000000-00002164.00000001.218716.58900000.00000004.mdmp\n 00000000-00002164.00000002.220638.58900000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.124.12.162\" found in string \"€4.124.12.162:10555\"\n \"127.15.45.35:\"\n \"147.15.45.35\"\n \"127.15.45.35\"\n \"147.15.48.35\"\n \"2.5.29.37\"\n \"147.15.48.39\"\n \"177.202.50.185\"\n \"191.247.146.103\"\n \"190.213.231.49\"\n \"188.163.102.106\"\n \"85.102.19.250\"\n \"167.234.244.29\"\n \"177.202.28.120\"\n \"177.202.50.57\"\n \"69.173.206.211\"\n \"162.35.99.85\"\n \"177.86.4.1\"\n \"95.26.206.250\"\n Potential IP \"192.0.2.0\" found in string \"ip1 = IPv4Network('192.0.2.0/26')\"\n Potential IP \"192.0.2.64\" found in string \"ip2 = IPv4Network('192.0.2.64/26')\"\n Potential IP \"192.0.2.128\" found in string \"ip3 = IPv4Network('192.0.2.128/26')\"\n Potential IP \"192.0.2.192\" found in string \"ip4 = IPv4Network('192.0.2.192/26')\"\n Potential IP \"192.0.2.0\" found in string \"[IPv4Network('192.0.2.0/24')]\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nAccept-Encoding: identity\nHost: api.ipify.org\nUser-Agent: Python-urllib/3.14\nConnection: close\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"dogkong-seed2.duckdns.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ipify.org/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ipify.org\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent python-urllib/3.14","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.74.152\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"_raw_aes.pyd\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in process \"00000000-00002252\"\n YARA signature for zlib compression library used in process \"00000000-00002164\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00002252\"\n YARA signature for file using Zlib compression matched on process \"00000000-00002164\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: DogKong_v8.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"DogKong_v8.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 222A0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DogKong_v8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: DogKong_v8.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"DogKong_v8.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.06312000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.17925000.00000002.mdmp, 00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp, 00000000-00002164.00000001.218716.0E584000.00000002.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.F9DE3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.043AC000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.06968000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"DogKong_v8.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002164.00000000.216797.0B864000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found reference to API \"Exception ignored while calling ctypes.DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002164.00000000.216797.0B864000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secrets\" (Indicator: \"secret\"; Source: \"00000000-00002164.00000000.216797.5A640000.00000004.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000000.216797.5C5E0000.00000004.mdmp, 00000000-00002164.00000001.218716.5A640000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5C5E0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A640000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5C5E0000.00000004.mdmp\")\n Found string \"argon2._password_hasher\" (Indicator: \"password\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5C6E0000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5C6E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Route attribute access on a class to __getattr__.\" (Indicator: \"route\"; Source: \"00000000-00002164.00000000.216797.5A760000.00000004.mdmp, 00000000-00002164.00000001.218716.5A760000.00000004.mdmp, 00000000-00002164.00000002.220638.5A760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: DogKong_v8.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"DogKong_v8.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"DogKong_v8.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"DogKong_v8.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.FA345000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"DogKong_v8.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: DogKong_v8.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"DogKong_v8.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002164.00000000.216797.213F3000.00000002.mdmp, 00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.FA890000.00000002.mdmp, 00000000-00002164.00000002.220638.04658000.00000002.mdmp, 00000000-00002164.00000002.220638.1F113000.00000002.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DogKong_v8.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"B50F119BF753DD010000000000000000000000000200000000\")\n \"DogKong_v8.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CB077A9BF753DD010000000000000000000000000200000000\")\n \"DogKong_v8.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: DogKong_v8.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"DogKong_v8.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"B50F119BF753DD010000000000000000000000000200000000\")\n \"DogKong_v8.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CB077A9BF753DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002164.00000000.216797.5A860000.00000004.mdmp, 00000000-00002164.00000001.218716.5A860000.00000004.mdmp, 00000000-00002164.00000002.220638.5A860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fread\" (Source: DogKong_v8.exe, API is part of module: MSVCRT.DLL)\n Found string \"fwrite\" (Source: DogKong_v8.exe, API is part of module: MSVCRT.DLL)\n Found string \"fseek\" (Source: DogKong_v8.exe, API is part of module: MSVCRT.DLL)\n Found string \"fopen\" (Source: DogKong_v8.exe, API is part of module: MSVCRT.DLL)\n Found string \"AreFileApisANSI\" (Source: DogKong_v8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: DogKong_v8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: DogKong_v8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: DogKong_v8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: DogKong_v8.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"DogKong_v8.exe\" has section name .rsrc with entropy \"7.5548822354346745\"\n \"_ec_ws.pyd\" has section name .rdata with entropy \"7.696659562266471\"\n \"_raw_aes.pyd\" has section name .rdata with entropy \"7.458571613962821\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"DogKong_v8.exe\" has resource with unusual entropy \"RT_ICON:7.950949195950686\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$58","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.74.152 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted a file with a known ransomware suffix","description":"$59","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002164-00002713-2377328608\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002164.00000000.216797.58900000.00000004.mdmp, 00000000-00002164.00000001.218716.14E14000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"DogKong_v8.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010817\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"161\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"144\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"145\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"DogKong_v8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"DogKong_v8.exe\" opened \"C:\\dogk_data_v2\\wallet.json.tmp\" with delete access\n \"DogKong_v8.exe\" opened \"C:\\dogk_data_v2\\seeds.json.tmp\" with delete access\n \"DogKong_v8.exe\" opened \"C:\\dogk_data_v2\\peers.json.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=1\" (Source: \"00000000-00002164-00000C47-5470420684\")\n Found string \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555\" (Source: \"00000000-00005996-00000C47-235567332\")\n Found string \"/c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1\" (File: \"cmd.exe\")\n Found string \":\\WINDOWS\\system32\\cmd.exe /c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1\" (Source: \"00000000-00002164.00000000.216797.58900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"VCRUNTIME140.dll\" claimed CRC 20799152 while the actual is CRC 123501\n \"VCRUNTIME140_1.dll\" claimed CRC 123501 while the actual is CRC 52724\n \"_ec_ws.pyd\" claimed CRC 52724 while the actual is CRC 818563\n \"_ssl.pyd\" claimed CRC 304477 while the actual is CRC 202483\n \"_cffi_backend.cp314-win_amd64.pyd\" claimed CRC 202483 while the actual is CRC 226145\n \"_ctypes.pyd\" claimed CRC 163451 while the actual is CRC 175193\n \"_bz2.pyd\" claimed CRC 175193 while the actual is CRC 106060\n \"_socket.pyd\" claimed CRC 106060 while the actual is CRC 122108\n \"_asyncio.pyd\" claimed CRC 122108 while the actual is CRC 140274\n \"_ed448.pyd\" claimed CRC 140274 while the actual is CRC 117947\n \"_curve448.pyd\" claimed CRC 83952 while the actual is CRC 103685\n \"_raw_des.pyd\" claimed CRC 108058 while the actual is CRC 108192\n \"_queue.pyd\" claimed CRC 91830 while the actual is CRC 83656\n \"_raw_aes.pyd\" claimed CRC 83656 while the actual is CRC 60996","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n DeleteFileW\n GetFileAttributesExW\n GetCommandLineW\n GetFileSizeEx\n GetModuleHandleW\n GetModuleHandleExW\n GetDriveTypeW\n WriteFile\n CreateProcessW\n CreateToolhelp32Snapshot\n FindFirstFileW\n GetTempPathW\n GetCommandLineA\n Sleep\n UnhandledExceptionFilter\n GetStartupInfoW\n FindNextFileW\n GetModuleFileNameW\n TerminateProcess\n Process32FirstW\n IsDebuggerPresent\n LoadLibraryExW\n OpenProcess\n VirtualProtect\n CreateDirectoryW\n GetProcAddress\n Process32NextW\n FindFirstFileExW\n CreateFileW\n GetCursorPos\n VirtualAlloc\n GetSystemInfo\n LoadLibraryExA\n CreateThread\n GetComputerNameExW\n WSASocketW\n bind\n recvfrom\n recv\n send\n closesocket\n WSAStartup\n sendto\n listen\n connect\n accept\n ConnectNamedPipe\n socket\n WSASendTo\n WSASend","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"VCRUNTIME140.dll\" claims program is from Mon Nov 21 08:39:02 2033\n \"VCRUNTIME140_1.dll\" claims program is from Thu Jun 10 23:23:34 1982","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 14 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555\" (UID: 00000000-00003628)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"DogKong_v8.exe\" (UID: 00000000-00002252)\n Spawned process \"DogKong_v8.exe\" (UID: 00000000-00002164)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00007836)\n Spawned process \"cmd.exe\" with commandline \"/c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1\" (UID: 00000000-00005996)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555\" (UID: 00000000-00003628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"intel_graph":{"map":{"Domain:api.ipify.org":{"type":"Domain","value":"api.ipify.org"},"Domain:dogkong-seed2.duckdns.org":{"type":"Domain","value":"dogkong-seed2.duckdns.org"},"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4":{"type":"File","value":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},"File:0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb":{"type":"File","value":"0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb"},"File:1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683":{"type":"File","value":"1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683"},"File:1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073":{"type":"File","value":"1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073"},"File:1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9":{"type":"File","value":"1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9"},"File:29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504":{"type":"File","value":"29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504"},"File:320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc":{"type":"File","value":"320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc"},"File:3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603":{"type":"File","value":"3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603"},"File:520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d":{"type":"File","value":"520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d"},"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8":{"type":"File","value":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},"File:6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706":{"type":"File","value":"6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706"},"File:7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d":{"type":"File","value":"7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d"},"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74":{"type":"File","value":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74"},"File:98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2":{"type":"File","value":"98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2"},"File:9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28":{"type":"File","value":"9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28"},"File:a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc":{"type":"File","value":"a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc"},"File:aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732":{"type":"File","value":"aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732"},"File:b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58":{"type":"File","value":"b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58"},"File:c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d":{"type":"File","value":"c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d"},"File:cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca":{"type":"File","value":"cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca"},"File:d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862":{"type":"File","value":"d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862"},"File:ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c":{"type":"File","value":"ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c"},"File:f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1":{"type":"File","value":"f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1"},"Ip:147.15.48.39":{"type":"Ip","value":"147.15.48.39"},"Ip:162.35.99.85":{"type":"Ip","value":"162.35.99.85"},"Ip:167.234.244.29":{"type":"Ip","value":"167.234.244.29"},"Ip:172.67.74.152":{"type":"Ip","value":"172.67.74.152"},"Ip:177.202.28.120":{"type":"Ip","value":"177.202.28.120"},"Ip:177.202.50.185":{"type":"Ip","value":"177.202.50.185"},"Ip:177.202.50.57":{"type":"Ip","value":"177.202.50.57"},"Ip:177.86.4.1":{"type":"Ip","value":"177.86.4.1"},"Ip:188.163.102.106":{"type":"Ip","value":"188.163.102.106"},"Ip:190.213.231.49":{"type":"Ip","value":"190.213.231.49"},"Ip:191.247.146.103":{"type":"Ip","value":"191.247.146.103"},"Ip:69.173.206.211":{"type":"Ip","value":"69.173.206.211"},"Ip:85.102.19.250":{"type":"Ip","value":"85.102.19.250"},"Ip:95.26.206.250":{"type":"Ip","value":"95.26.206.250"},"Url:/":{"type":"Url","value":"/"}},"chains":[{"id":"sandbox_network","root":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","edges":[{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:172.67.74.152"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:147.15.48.39"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:177.202.50.185"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:191.247.146.103"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:190.213.231.49"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:188.163.102.106"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:85.102.19.250"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:167.234.244.29"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:177.202.28.120"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:177.202.50.57"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:69.173.206.211"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:162.35.99.85"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:177.86.4.1"},{"edge_kind":"contacted_ip","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Ip:95.26.206.250"},{"edge_kind":"contacted_domain","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Domain:api.ipify.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.ipify.org","to_key":"Ip:172.67.74.152"},{"edge_kind":"contacted_domain","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Domain:dogkong-seed2.duckdns.org"},{"edge_kind":"resolves_to","from_key":"Domain:dogkong-seed2.duckdns.org","to_key":"Ip:147.15.48.39"},{"edge_kind":"contacted_url","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","edges":[{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683"},{"edge_kind":"extracted","from_key":"File:7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","to_key":"File:d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":141,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":250,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":14,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac23f1747a056155b0cf44e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Blank.Script","contacted_countries":["BRA","RUS","TTO","TUR","UKR","USA"],"submit_name":"DogKong_v8.exe","analysis_start_time":"2026-10-04T11:57:15+00:00","indicators_count":{"informative":184,"suspicious":44,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.74.152","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"147.15.48.39","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"177.202.50.185","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"191.247.146.103","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"190.213.231.49","port":18555,"protocol":"TCP","country":"Trinidad & Tobago","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"188.163.102.106","port":18555,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"85.102.19.250","port":18555,"protocol":"TCP","country":"Türkiye","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"167.234.244.29","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"177.202.28.120","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"177.202.50.57","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"69.173.206.211","port":18555,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"162.35.99.85","port":18555,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"177.86.4.1","port":18555,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"address":"95.26.206.250","port":18555,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"172.67.74.152","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"domain":"dogkong-seed2.duckdns.org","address":"147.15.48.39","ttl":60,"country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"172.67.74.152:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nAccept-Encoding: identity\nHost: api.ipify.org\nUser-Agent: Python-urllib/3.14\nConnection: close","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}],"processes":[{"pid":2252,"ppid":0,"name":"DogKong_v8.exe","command_line":"","sha256":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","normalized_path":"C:\\DogKong_v8.exe","uid":"00000000-00002252","icon":"$5a"},{"pid":2164,"ppid":2252,"name":"DogKong_v8.exe","command_line":"","sha256":"7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74","normalized_path":"C:\\DogKong_v8.exe","parent_uid":"00000000-00002252","uid":"00000000-00002164"},{"pid":7836,"ppid":2164,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002164","uid":"00000000-00007836"},{"pid":5996,"ppid":2164,"name":"cmd.exe","command_line":"/c netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002164","uid":"00000000-00005996"},{"pid":3628,"ppid":5996,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"DogKong P2P\" dir=in action=allow protocol=TCP localport=18555","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00005996","uid":"00000000-00003628"}],"all_imported_dlls":["uxtheme.dll","version.dll","libcrypto-3.dll","crypt32.dll","netutils.dll","comdlg32.dll","ntasn1.dll","sstpcfg.dll","eappprxy.dll","tdh.dll","netshell.dll","rpcnsh.dll","WcnNetsh.dll","rpcrt4.dll","combase.dll","user32.dll","CoreMessaging.dll","cryptbase.dll","dhcpcmonitor.dll","nshipsec.dll","ws2_32.dll","profapi.dll","mswsock.dll","cfgmgr32.dll","mprmsg.dll","fastprox.dll","sppc.dll","vcruntime140.dll","winipsec.dll","netprofm.dll","msctf.dll","kernel.appcore.dll","MpOAV.dll","63OdAl7i.dll","zlib1.dll","FWPUCLNT.DLL","TextInputFramework.dll","NetSetupApi.dll","clbcatq.dll","fwpolicyiomgr.dll","polstore.dll","nshwfp.dll","P2P.dll","logoncli.dll","SHCore.dll","dnsapi.dll","ifmon.dll","dot3cfg.dll","ncrypt.dll","Wldap32.dll","wwancfg.dll","win32u.dll","sechost.dll","winnsi.dll","cryptsp.dll","msvcp140.dll","samcli.dll","dhcpcsvc6.dll","gdi32.dll","python3.dll","mfc42u.dll","FirewallAPI.dll","advapi32.dll","mfc42.dll","hnetmon.dll","nettrace.dll","wcmapi.dll","WinTypes.dll","nshhttp.dll","imm32.dll","wbemprox.dll","wbemcomn.dll","tcl86t.dll","TextShaping.dll","psapi.dll","rasman.dll","wlancfg.dll","shlwapi.dll","wbemsvc.dll","userenv.dll","shell32.dll","rasapi32.dll","fwcfg.dll","PeerDistSh.dll","gdi32full.dll","whhelper.dll","netapi32.dll","ntdll.dll","msvcp_win.dll","comctl32.dll","nsi.dll","CoreUIComponents.dll","oleaut32.dll","IPHLPAPI.DLL","onex.dll","httpapi.dll","WwanPrfl.dll","ktmw32.dll","vcruntime140_1.dll","VCRUNTIME140_1.dll","rasadhlp.dll","dot3api.dll","adsldpc.dll","wshelper.dll","tk86t.dll","msvcrt.dll","amsi.dll","kernel32.dll","KernelBase.dll","bcrypt.dll","netiohlp.dll","dhcpcsvc.dll","ntmarta.dll","rasmontr.dll","authfwcfg.dll","fwbase.dll","wwapi.dll","gpapi.dll","VxSSL64.dll","python314.dll","bcryptprimitives.dll","libssl-3.dll","rtutils.dll","p2pnetsh.dll","slc.dll","fltLib.dll","propsys.dll","msasn1.dll","wlanapi.dll","winhttp.dll","libffi-8.dll","prxyqry.dll","mobilenetworking.dll","ucrtbase.dll","mprapi.dll","eappcfg.dll","activeds.dll","wevtapi.dll","VCRUNTIME140.dll","cabinet.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_raw_des.pyd","sha256":"0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_des3.pyd","sha256":"b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"VCRUNTIME140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"VCRUNTIME140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_Salsa20.pyd","sha256":"9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_chacha20.pyd","sha256":"ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_aes.pyd","sha256":"520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_aesni.pyd","sha256":"3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_ARC4.pyd","sha256":"f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_pkcs1_decode.pyd","sha256":"320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_arc2.pyd","sha256":"1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_blowfish.pyd","sha256":"6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_cast.pyd","sha256":"7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_cbc.pyd","sha256":"a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_cfb.pyd","sha256":"cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_ctr.pyd","sha256":"aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_ecb.pyd","sha256":"98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_eksblowfish.pyd","sha256":"29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_ocb.pyd","sha256":"c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_raw_ofb.pyd","sha256":"1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_BLAKE2b.pyd","sha256":"1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"_BLAKE2s.pyd","sha256":"d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"files_written":[{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\PublicKey\\_curve25519.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\PublicKey\\_curve448.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\Crypto\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_argon2_cffi_bindings\\_ffi.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_cffi_backend.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-11.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\koi8-ru.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\koi8-t.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\history.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\init.tcl","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\he.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\hi.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\hi_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\hr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\hu.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\id.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\id_id.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\is.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\it.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\it_ch.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ja.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kl.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kl_gl.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ko.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ko_kr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kok.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kok_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kw.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\kw_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\lt.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\lv.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\mk.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\mr.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\mr_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ms.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\ms_my.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\mt.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\nb.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\_tcl_data\\msgs\\nl.msg","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%TEMP%\\_MEI000008cc2\\memory_table.bin","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"C:\\dogk_data_v2\\wallet.json.tmp","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"C:\\dogk_data_v2\\seeds.json.tmp","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"C:\\dogk_data_v2\\peers.json.tmp","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"C:\\dogk_data_v2\\peers.json.bak","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Local\\SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Local\\SM0:2164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"SM0:2164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Local\\SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Local\\SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"Local\\SM0:3628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]},{"name":"SM0:3628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac23f1747a056155b0cf44e"}]}]}},"report_ids":{"sandbox_job_ids":["6ac23f1747a056155b0cf44e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 7f78a8d844a3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7f78a8d844a3…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 7f78a8d844a3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7f78a8d844a3…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 7f78a8d844a3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7f78a8d844a3…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]