26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 8a4f593a0bfa… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 8a4f593a0bfa…. Malware family: Win/malicious_confidence_70%. Threat score 80/100. 1/28 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea"],"about":{"@type":"SoftwareApplication","name":"Windows-Office License Management System v2.0.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2539,Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")28:T21bb,file/memory contains long string(File: "libssl-1_1.dll") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp") Found string "Interface to the liblzma compression library." (Source: "00000000-00005252.00000000.118004.27050000.00000004.mdmp, 00000000-00005252.00000001.119926.27050000.00000004.mdmp, 00000000-00005252.00000002.121846.27050000.00000004.mdmp, 00000000-00005252.00000003.128841.27050000.00000004.mdmp") Found string "classes for incremental (de)compression, and convenience functions for" (Source: "00000000-00005252.00000000.118004.27050000.00000004.mdmp, 00000000-00005252.00000001.119926.27050000.00000004.mdmp, 00000000-00005252.00000002.121846.27050000.00000004.mdmp, 00000000-00005252.00000003.128841.27050000.00000004.mdmp") Found string "one-shot (de)compression." (Source: "00000000-00005252.00000000.118004.27050000.00000004.mdmp, 00000000-00005252.00000001.119926.27050000.00000004.mdmp, 00000000-00005252.00000002.121846.27050000.00000004.mdmp, 00000000-00005252.00000003.128841.27050000.00000004.mdmp") Found string "the appropriate compression extension (".gz", ".bz2", or ".xz")." (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "and 9 specifying the level of compression: 1 produces the least" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "compression, and 9 (default) produces the most compression." (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "compression settings, as for LZMACompressor, LZMADecompressor and" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.44221000.00000040.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000000.118004.27BF0000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.449E1000.00000040.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp, 00000000-00005252.00000002.121846.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp, 00000000-00005252.00000003.128841.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.449E1000.00000040.mdmp") Found string "compressor can be specified either as a preset compression" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "chain; the raw compressor does not support preset compression" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.44221000.00000040.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.44221000.00000040.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.449E1000.00000040.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.44221000.00000040.mdmp, 00000000-00005252.00000003.128841.449E1000.00000040.mdmp") Found string "A file object providing transparent bzip2 (de)compression." (Source: "00000000-00005252.00000000.118004.279E0000.00000004.mdmp, 00000000-00005252.00000000.118004.27C30000.00000004.mdmp, 00000000-00005252.00000002.121846.279E0000.00000004.mdmp, 00000000-00005252.00000002.121846.27C30000.00000004.mdmp, 00000000-00005252.00000003.128841.279E0000.00000004.mdmp") Found string "A file object providing transparent LZMA (de)compression." (Source: "00000000-00005252.00000000.118004.279E0000.00000004.mdmp, 00000000-00005252.00000000.118004.27C30000.00000004.mdmp, 00000000-00005252.00000002.121846.279E0000.00000004.mdmp, 00000000-00005252.00000002.121846.27C30000.00000004.mdmp, 00000000-00005252.00000003.128841.279E0000.00000004.mdmp") Found string "For incremental decompression, use a BZ2Decompressor object instead." (Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp") Found string "_compression" (Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp") Found string "bad value for 'compress', or compression format not supported : {0}" (Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp") Found string "Interface to the libbzip2 compression library." (Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp") Found string "(de)compression, and functions for one-shot (de)compression." (Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp") Found string "For incremental compression, use an LZMACompressor instead." (Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp")29:T8cd,Found string "Get-ChildItem -Path $yol -Filter "*.lnk" -Recurse | Where-Object { $_.Name -match "Word|Excel|PowerPoint|Outlook|Access|Publisher|OneNote|Office" } | Remove-Item -Force" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Remove-Item -Path $_.PSPath -Recurse -Force" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path "$regPath\Common\Identity") { Remove-Item -Path "$regPath\Common\Identity" -Recurse -Force }" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $licPath1) { Remove-Item -Path $licPath1 -Recurse -Force }" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $licPath2) { Remove-Item -Path $licPath2 -Recurse -Force }" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Remove-Item -Path "$env:PROGRAMDATA\Microsoft\Office\Licenses" -Recurse -Force" (Indicator: "Remove-Item"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")2a:T8da,"OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-557597405 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-557606096 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-557855154 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-557862648 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-558007243 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005988-00000C15-558015395 [PID: 5988] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-564731038 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-564739097 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-564940708 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-564949129 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-565092819 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-565101281 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-566959729 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-566968048 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-567377684 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-567385792 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-570040688 [PID: 5252] "OfficeLicenseManagementSystemv2.0.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-570049211 [PID: 5252]2b:T8078,Found XOR loop in file "setup.exe" at offset 114949; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 674375; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1698872; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 2403400; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 2762194; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 3685674; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 507392; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719091; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719098; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719121; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719128; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719147; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719157; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719345; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 719352; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 881326; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1086861; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1206712; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1206764; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1240684; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1248702; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1341607; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1358884; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1531705; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532459; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532478; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532497; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532516; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532535; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532554; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532573; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532595; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1532630; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1686996; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1734727; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1734881; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1734953; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1735019; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1866037; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1866094; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1866153; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1866212; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1969762; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1969770; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2025098; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2082538; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2090827; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2090832; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2157166; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2245236; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2275577; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2282677; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2290865; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2290870; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2360965; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2430068; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2449230; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2516324; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2516546; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2516661; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2516973; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2517091; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2555209; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593012; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593142; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593162; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593298; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593324; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2593460; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2594340; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2594499; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2595759; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2595897; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596044; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596188; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596406; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596544; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596691; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596835; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2596987; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2597128; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2597668; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2597812; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2597956; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2598097; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2598243; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2598382; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2599274; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2599352; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2600073; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2600173; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2600744; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2600974; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2601185; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2602082; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2602510; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2603141; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2603518; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2610469; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2610487; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2616895; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2689836; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2723574; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724455; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724539; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724552; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724779; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724868; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2724872; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725261; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725348; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725471; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725536; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725563; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725628; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725655; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725719; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2725746; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2726112; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2726150; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2726219; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2726311; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2726415; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2738153; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2738205; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2739524; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2751596; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752172; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752302; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752432; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752562; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752692; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752819; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2752923; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753053; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753183; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753313; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753417; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753547; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753722; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753829; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2753956; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754086; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754212; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754238; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754242; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754342; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754368; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754372; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754472; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754498; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754502; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754602; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754661; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754791; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2754921; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755039; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755051; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755143; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755169; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755181; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755273; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755299; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755311; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755573; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755690; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2755786; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2781526; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2781906; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2782294; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2782690; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2783070; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2783458; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2783854; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2784897; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2785277; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2785665; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2786061; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2786441; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2786829; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2787225; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 3868355; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 4165575; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 4166720; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 4771872; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 5084395; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 2728853; code bytes = 30040e Found XOR loop in file "setup.exe" at offset 982026; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 984124; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 986495; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1068837; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1217549; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1334583; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 2265531; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 3715687; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 3956067; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 5233066; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 5234473; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 5235112; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1142391; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1144523; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1145263; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1147399; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1148339; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1150171; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1151407; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1152799; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1152839; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1155563; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1156979; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1161791; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1167444; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1169423; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1170067; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1172063; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1172887; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1181975; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1182003; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1188935; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1194107; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1194395; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211939; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1212827; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1296708; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1315200; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 118520; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 389916; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 389922; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 389967; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 393201; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 393573; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 563959; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 571022; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 603833; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 645981; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 668301; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 668308; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 668335; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 668406; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 736201; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 814649; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 837058; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 914167; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 914232; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 921319; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 1035917; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1083171; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1117303; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1157752; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1220580; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1291048; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1316464; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1357110; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 51165; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 107798; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 167752; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 229361; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 253589; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 256648; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 319712; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 572897; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 697840; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 698535; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 725767; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 755882; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 756982; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 882048; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 914372; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 946391; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 984732; code bytes = 30d0 Found XOR loop in file "python37.dll" at offset 60314; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 73881; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 135281; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 195224; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 332716; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 381867; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 419945; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 464654; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 541601; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 573365; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 692872; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 705366; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 1060531; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 1161613; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 1166260; code bytes = 33c1 Found XOR loop in file "python37.dll" at offset 15020; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 295411; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 453427; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 611289; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 665884; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 784240; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 866848; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 882738; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 1120674; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 1243900; code bytes = 8030 Found XOR loop in file "python37.dll" at offset 1246759; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3765; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 40075; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 138620; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 197221; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 244511; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 342836; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 477725; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 495425; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 676053; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 680318; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 727008; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 738030; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 740418; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 756410; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 788477; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 950716; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 953231; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 1005758; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 134530; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 159317; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 172766; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 413814; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 503226; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 715367; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 753372; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 783210; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 830855; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 843808; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 850821; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 898561; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 928090; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 934723; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 966233; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 981105; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 33399; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 210228; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 223643; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 327093; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 327990; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 364151; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 372682; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 393607; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 440157; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 599025; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 633468; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 845635; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 915410; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 980208; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1042696; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1168124; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1170983; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 12546; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 46072; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 156181; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 189300; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 248026; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 379682; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 425235; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 468679; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 486674; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 503607; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 574502; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 583837; code bytes = 30d0 Found XOR loop in file "tcl86t.dll" at offset 142854; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 181747; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 207579; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 288167; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 294764; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 309072; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 380697; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 509875; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 589634; code bytes = 33c1 Found XOR loop in file "tcl86t.dll" at offset 24143; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 36427; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 271481; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 295770; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 366441; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 473880; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 491026; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 499513; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 543124; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 631036; code bytes = 8030 Found XOR loop in file "tcl86t.dll" at offset 634006; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 16820; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 57558; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 151985; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 225096; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 242444; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 471742; code bytes = 30d0 Found XOR loop in file "tk86t.dll" at offset 332050; code bytes = 33c1 Found XOR loop in file "tk86t.dll" at offset 390624; code bytes = 33c1 Found XOR loop in file "tk86t.dll" at offset 473477; code bytes = 30040e Found XOR loop in file "tk86t.dll" at offset 40325; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 74777; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 77367; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 242857; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 250943; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 337430; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 399832; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 442908; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 477239; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 493451; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 515439; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 519939; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 520195; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 604412; code bytes = 8030 Found XOR loop in file "tk86t.dll" at offset 607382; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 96083; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 200614; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 9474; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 25617; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 140128; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 34220; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 39231; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 78217; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 196348; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 199207; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 200459; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 16046; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 49308; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 79352; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 86820; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 54012; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 56871; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-math-l1-1-0.dll" at offset 25909; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-string-l1-1-0.dll" at offset 21830; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-stdio-l1-1-0.dll" at offset 20144; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-stdio-l1-1-0.dll" at offset 21829; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-runtime-l1-1-0.dll" at offset 21814; code bytes = 8030 Found XOR loop in file "api-ms-win-core-file-l1-1-0.dll" at offset 21814; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-convert-l1-1-0.dll" at offset 21843; code bytes = 8030 Found XOR loop in file "api-ms-win-core-processthreads-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-errorhandling-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-namedpipe-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-process-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-time-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-heap-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-synch-l1-2-0.dll" at offset 17734; code bytes = 8030 Found XOR loop in file "api-ms-win-core-localization-l1-2-0.dll" at offset 17734; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-locale-l1-1-0.dll" at offset 17734; code bytes = 8030 Found XOR loop in file "api-ms-win-core-kernel32-legacy-l1-1-1.dll" at offset 17734; code bytes = 80302c:Tdaa,Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp, 00000000-00005252.00000001.119926.26F80000.00000004.mdmp, 00000000-00005252.00000002.121846.26F80000.00000004.mdmp, 00000000-00005252.00000003.128841.26F80000.00000004.mdmp")2d:T58d,Found string "Get-ChildItem -Path $yol -Filter "*.lnk" -Recurse | Where-Object { $_.Name -match "Word|Excel|PowerPoint|Outlook|Access|Publisher|OneNote|Office" } | Remove-Item -Force" (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Get-ChildItem -Path $reg | ForEach-Object {" (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$usersDirs = Get-ChildItem -Path "C:\Users" -Directory" (Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")2e:T1717,"OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000002051ce27260200001019266af97f0000000000000000000000005969f97f00000000000000000000ee26d467f97f00000700000000000000603d9e9d35000000603d9e9d35000000400ee267f97f000000005969f97f00007b639167f97f0000020000000000000000000000000000009200000000000000a004c969f97f0000503d9e9d35000000bb5fd467f97f00000d000000f97f0000a004c969f97f000092000000000000000000000000000000a004c969f97f00001c5bd467f97f0000000000000000000092000000000000000d000000f97f00000d00000000000000aa00000000000000d2456a69f97f0000a03a6f69 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005b6ba23df97f00000000000000000000000000000000000000008e3df97f00001019266af97f000000000000eb271c0000000000000400bc00008e3df97f000001000000000000000000000000000000956ca23df97f000007000000000000000003fe7f00000000184b9e9d35000000e4dd073ef97f00000003fe7f000000002066a23df97f00000003fe7f (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000007092162726020000a8ed863df97f0000507c9e9d35000000a8ed863df97f000064df973df97f00000000000000000000bbc2392b000000007092162726020000f55d9e3df97f00000000000000000000e402030000000000a8ed863df97f00009091162726020000c02a843df97f0000f55d9e3df97f0000c0b6552826020000a00457282602000050da592826020000e402030000000000c02a843df97f000080ea9c3df97f00000400000000000000a00457282602000050da592826020000b06359282602000050da592826020000f76a833df97f0000010000002602000020b8883df97f0000d086492826020000e40203000000000060515128 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000a003d02626020000b4719e9d350000000d000000030000004db4236af97f00000000d02626020000a85e276af97f000000000000000000009e3d0565f97f00009803d02626020000f4719e9d35000000b0d9ec2726020000a0d9ec27260200000000000000000000343d0565f97f0000b0d9ec2726020000b0d9ec2726020000b0d9ec2726020000000000000000000000000000000000003ba39367f97f00000000000000000000a85e276af97f000070739e9d3500000090ab6528260200000d0a1a0a000000000000000000000000d00000000000000090ab6528260200000000000000000000409dd769f97f000000000000 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027f9c65b876f00000000000000000000000000000000000088819e9d35000000b0809e9d35000000108a91292602000080819e9d35000000c0349429260200000000000000000000f55d9e3df97f0000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005252)2f:T7d3,"OfficeLicenseManagementSystemv2.0.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a00000200000000020000768bab3df97f0000ffffffffffffffff0000000026020000f0440827260200009cf8aa3df97f00000a00000000000000a0d7e22626020000000000000000000000000000f97f000088582c25000000000000000026020000d8562c2526020000f0042b252602000000000000260200001243311d1c5311d84836cb26 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a00000200000000020000768bab3df97f0000ffffffffffffffff00000000260200007f0000000000000090091f27260200000a0000000000000098091f2726020000ffffffffffffffff00000000f97f000088582c25000000000000000026020000d8562c2526020000f0042b252602000000000000260200001243311d1c5311d84836cb26 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a000002000000000000003053d93df97f00003053d93df97f00009cefaa3df97f0000b048ca2626020000986ac43df97f000080e10d2826020000f0e2e226260200009042e426260200006064aa3df97f0000020000000000000048e5cd26260200000000000000000000000000000000000080000000000000000000000000000000e05a0d28 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a000002000000000000000000000000000000ffffffffffffffff0000000026020000b09b1728260200009cf8aa3df97f00000a00000000000000a0d7e22626020000000000000000000000000000000000000000000000000000000000000000000000000000000000006078cb27260200000000000000000000000000000000000000000000 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a00000200000000020000d8051f2726020000ffffffffffffffff00000000260200007f0000000000000030952f25260200000a0000000000000038952f2526020000ffffffffffffffff0000000035000000b097142800000000000000002602000000000000000000006078cb272602000000000000000000000000000000000000c8051f27 (UID: 00000000-00005252)30:T416,Found string "$apps = Get-WmiObject -Query "SELECT * FROM SoftwareLicensingProduct WHERE ApplicationId='0ff1ce15-a989-479d-af46-f275c6370663' AND PartialProductKey IS NOT NULL"" (Indicator: "select * from "; Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp") Found string "query("SELECT * FROM table") # ok" (Indicator: "select * from "; Source: "00000000-00005252.00000000.118004.280F0000.00000004.mdmp, 00000000-00005252.00000001.119926.280F0000.00000004.mdmp, 00000000-00005252.00000002.121846.280F0000.00000004.mdmp, 00000000-00005252.00000003.128841.280F0000.00000004.mdmp") Found string "query(f"SELECT * FROM {input()}") # not ok" (Indicator: "select * from "; Source: "00000000-00005252.00000000.118004.280F0000.00000004.mdmp, 00000000-00005252.00000001.119926.280F0000.00000004.mdmp, 00000000-00005252.00000002.121846.280F0000.00000004.mdmp, 00000000-00005252.00000003.128841.280F0000.00000004.mdmp")31:T46d,Observed string: "command /c verz" (Indicator: "/c ver") in Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp Observed string: "cmd /c ver" (Indicator: "cmd /c ver") in Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp 00000000-00005252.00000000.118004.28070000.00000004.mdmp 00000000-00005252.00000001.119926.28070000.00000004.mdmp 00000000-00005252.00000002.121846.28070000.00000004.mdmp 00000000-00005252.00000003.128841.28070000.00000004.mdmp Observed string: "cmd /c ver" (Indicator: "/c ver") in Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp 00000000-00005252.00000000.118004.28070000.00000004.mdmp 00000000-00005252.00000001.119926.28070000.00000004.mdmp 00000000-00005252.00000002.121846.28070000.00000004.mdmp 00000000-00005252.00000003.128841.28070000.00000004.mdmp Observed string: "command /c ver" (Indicator: "/c ver") in Source: 00000000-00005252.00000000.118004.28070000.00000004.mdmp 00000000-00005252.00000001.119926.28070000.00000004.mdmp 00000000-00005252.00000002.121846.28070000.00000004.mdmp 00000000-00005252.00000003.128841.28070000.00000004.mdmp32:T1181,"OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer" at 00000000-00005988-00000C17-558491714 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\certifi" at 00000000-00005988-00000C17-559281826 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559288895 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559289854 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559294620 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559295585 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\fonts" at 00000000-00005988-00000C17-559296534 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559318615 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559319361 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\fonts" at 00000000-00005988-00000C17-559320189 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\fonts\Roboto" at 00000000-00005988-00000C17-559320958 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559344078 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559344849 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559349396 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559350128 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\icons" at 00000000-00005988-00000C17-559350870 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559355937 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559356736 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559361638 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559362360 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\themes" at 00000000-00005988-00000C17-559363084 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" at 00000000-00005988-00000C17-559367717 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" at 00000000-00005988-00000C17-559368450 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\themes" at 00000000-00005988-00000C17-559369355 "OfficeLicenseManagementSystemv2.0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\tcl8" at 00000000-00005988-00000C17-56036392933:T9b6,"OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "OfficeLicenseManagementSystemv2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME")34:Tdae,"OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\charset_normalizer (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\pyarmor_runtime_000000 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\certifi (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter\assets (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter\assets\fonts (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter\assets\fonts\Roboto (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter\assets\icons (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\customtkinter\assets\themes (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl8 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl8\8.4 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl8\8.4\platform (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl8\8.5 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl8\8.6 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\encoding (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\http1.0 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\msgs (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\opt0.4 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\tzdata (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\tzdata\Africa (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\tzdata\America (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\tzdata\America\Argentina (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI59882\tcl\tzdata\America\Indiana (UID: 00000000-00005988)35:T2310,"OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\ucrtbase.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-conio-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-process-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\python37.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-path-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\python3 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter python37.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_ctypes.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_bz2.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_lzma.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\pyarmor_runtime_000000\pyarmor_runtime.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter COMDLG32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter tcl86t.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter tk86t.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_tkinter.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_socket.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\select.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter libcrypto-1_1.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_hashlib.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter libssl-1_1.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_ssl.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\_queue.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter python3.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\charset_normalizer\cd.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\charset_normalizer\md.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI59882\unicodedata.pyd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter dwmapi (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005252)36:T1427f,"OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005988) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetVolumePathNameW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GenerateConsoleCtrlEvent (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetThreadTimes (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetNumberOfConsoleInputEvents (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CancelIo (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetNamedPipeHandleState (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WaitNamedPipeA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ReleaseSemaphore (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetSystemTimeAdjustment (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RemoveVectoredExceptionHandler (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegFlushKey (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegSaveKeyW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegLoadKeyW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegConnectRegistryW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegSetValueW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _putch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _ungetwch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getwch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getwche (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _ungetch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _putwch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getche (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcstol (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter mbstowcs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter getenv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __p__wenviron (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wgetenv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wputenv_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wgetcwd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wputenv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wstat64i32 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _umask (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _heapmin (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter localeconv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter setlocale (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter tan (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter exp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter frexp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter tanh (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter erfc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter sqrt (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter cosh (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter erf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fabs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter floor (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter cos (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ceil (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter sin (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter atan (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter acos (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter pow (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _finite (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _fdopen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter log10 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter round (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter asin (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter modf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter hypot (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ldexp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter log (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fmod (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _isnan (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter atan2 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter sinh (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _copysign (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wspawnve (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wexecv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wexecve (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wspawnv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _cwait (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _set_thread_local_invalid_parameter_handler (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getpid (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __fpe_flt_rounds (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter terminate (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _crt_at_quick_exit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _crt_atexit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _execute_onexit_table (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _set_abort_behavior (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _initialize_onexit_table (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _initialize_narrow_environment (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _seh_filter_dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _initterm_e (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _invalid_parameter_noinfo (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _endthreadex (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wsystem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter raise (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __sys_nerr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __sys_errlist (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _register_onexit_function (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _configure_narrow_argv (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _lseek (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wopen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _locking (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _commit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _lseeki64 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _chsize_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ferror (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __acrt_iob_func (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __stdio_common_vsprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter getc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _kbhit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _open_osfhandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __stdio_common_vfprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter feof (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fgets (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _setmode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fseek (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ungetc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter clearerr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _isatty (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _fileno (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter rewind (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _dup2 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _getcwd (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _close (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _write (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _dup (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _get_osfhandle (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _open (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _read (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsncpy_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsncmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter isdigit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsxfrm (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter isalpha (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter isxdigit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcstok_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcscat_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcscoll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcstok (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsnlen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcscpy_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter isalnum (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strftime (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _tzset (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _localtime64_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _gmtime64_s (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __timezone (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _mktime64 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter clock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __daylight (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PathCanonicalizeW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcschr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter wcsrchr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __C_specific_handler (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_DontWriteBytecodeFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_FileSystemDefaultEncoding (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_FrozenFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_IgnoreEnvironmentFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_NoSiteFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_NoUserSiteDirectory (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_OptimizeFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_VerboseFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_UnbufferedStdioFlag (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_UTF8Mode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_BuildValue (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_IncRef (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_SetPath (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_GetPath (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_SetProgramName (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_SetPythonHome (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_GetItemString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyList_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySys_AddWarnOption (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySys_SetArgvEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySys_SetPath (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PathCchCanonicalizeEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PathCchCombineEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter DisableThreadLibraryCalls (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter iswctype (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter ProgIDFromCLSID (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_AddStringConstant (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyType_IsSubtype (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_CallMethodId_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AsUnicodeAndSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_OverflowError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongMask (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_GetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_GetSlice (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDescr_NewGetSet (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_ExceptionMatches (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_AddObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_SetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_ParseTuple_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_Create2 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyType_Ready (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_NewException (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GenericSetAttr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_SetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_IsInstance (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyLong_Zero (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMem_Free (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromVoidPtr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AsWideChar (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_NoMemory (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_GetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsVoidPtr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_CallObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_InitThreads (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBytes_FromStringAndSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_DelItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyNumber_AsSsize_t (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_IsSubclass (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyWeakref_ProxyType (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_TypeError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_Pack (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCallable_Check (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMem_Malloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_IndexError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyArg_UnpackTuple (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_FastCallDict (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyType_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8AndSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_FromStringAndSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ImportModuleNoBlock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_WarnEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_RuntimeWarning (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GC_UnTrack (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyGILState_Release (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GC_Del (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyTraceback_Add (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFile_WriteString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GC_Track (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyGILState_Ensure (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_GC_NewVar (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_SetObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_Format (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBytes_AsString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_SaveThread (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyUnicode_AsUnicode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AppendAndDel (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_SetFromWindowsErr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormatV (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_CallMethodIdObjArgs (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_Free (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCapsule_GetPointer (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_AsWideCharString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_GetAttrId (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThreadState_GetDict (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCapsule_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyUnicode_IsPrintable (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_OSError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMem_Realloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_Call (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyArg_ParseTuple (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_RestoreThread (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBool_FromLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyFloat_Pack4 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromUnsignedLongLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyFloat_Unpack4 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFloat_AsDouble (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromLongLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFloat_FromDouble (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromUnsignedLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongLongMask (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFloat_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyFloat_Unpack8 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_IsTrue (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyByteArray_empty_string (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyFloat_Pack8 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyByteArray_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter Py_FatalError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_GetAttr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_Fast (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_Size (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_HasAttrString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyDict_SizeOf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyLong_AsInt (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyWeakref_CallableProxyType (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyUnicode_EqualToASCIIString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromSsize_t (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyWeakref_NewProxy (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_Update (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_Next (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _Py_CheckRecursiveCall (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_ValueError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_WriteUnraisable (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_SetString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_FromWideChar (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_GetSlice (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_AttributeError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMemoryView_FromObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_SetItemString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyTuple_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _Py_NoneStruct (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBuffer_IsContiguous (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_Concat (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySlice_Unpack (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_FromLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_GetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySlice_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsSsize_t (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_NoKeywords (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyType_GenericNew (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyObject_CallFunction_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _Py_BuildValue_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_Exception (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _Py_CheckRecursionLimit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySlice_AdjustIndices (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThreadState_Get (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDescr_NewClassMethod (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyUnicode_InternFromString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyObject_SetAttr (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_Size (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCapsule_IsValid (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_RuntimeError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PySequence_Tuple (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fgetc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_SystemError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThread_free_lock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_EOFError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyBytes_Resize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThread_release_lock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThread_acquire_lock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_NoPositional (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMem_RawMalloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyThread_allocate_lock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_ParseStackAndKeywords_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_MemoryError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_SetNone (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_Parse_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_ParseStack_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_ParseTupleAndKeywords_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_NewExceptionWithDoc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMapping_Check (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMapping_GetItemString (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongLong (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyDict_SetItemId (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_KeyError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_AddIntConstant (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _PyArg_ParseTupleAndKeywordsFast_SizeT (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualLock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter VirtualUnlock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter __iob_func (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _snprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _stat64 (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter _vsnprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter isprint (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBuffer_FillInfo (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBytes_AsStringAndSize (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBytes_Size (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyBytes_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCFunction_GetSelf (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCFunction_NewEx (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCFunction_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCell_Get (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCell_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCell_Set (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCode_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyCode_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyComplex_FromCComplex (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyComplex_ImagAsDouble (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyComplex_RealAsDouble (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyComplex_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyDict_Copy (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_CheckSignals (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_GivenExceptionMatches (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyErr_SetImportError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_GetBuiltins (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_GetFrame (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyEval_GetGlobals (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_NotImplementedError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_StopIteration (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_SystemExit (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyExc_UnboundLocalError (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyException_SetCause (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyException_SetContext (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyException_SetTraceback (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFrozenSet_New (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFrozenSet_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFunction_GetCode (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyFunction_NewWithQualName (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModuleObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_GetModule (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_GetModuleDict (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ImportModuleLevel (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyImport_ImportModuleLevelObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyIter_Next (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyList_AsTuple (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyList_GetItem (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyList_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyLong_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMemoryView_FromBuffer (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMethod_Function (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyMethod_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_GetFilenameObject (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_GetName (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyModule_Type (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter PyNumber_Add (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005252)37:T65c,"Insert an entry into the list of warnings filters (at the front)." (Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp, Indicator: "insert an entry into the list of warnings filters (at the front)."), "select_from" (Source: 00000000-00005252.00000000.118004.27190000.00000004.mdmp, 00000000-00005252.00000001.119926.27190000.00000004.mdmp, 00000000-00005252.00000003.128841.27190000.00000004.mdmp, Indicator: "select_from"), "Insert a simple entry into the list of warnings filters (at the front)." (Source: 00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp, Indicator: "insert a simple entry into the list of warnings filters (at the front)."), "inserts *copies* into it of the objects found in the original." (Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, Indicator: "inserts *copies* into it of the objects found in the original."), "selection_from" (Source: 00000000-00005252.00000000.118004.27FF0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FF0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FF0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FF0000.00000004.mdmp, Indicator: "selection_from")38:T78a,"ucrtbase.dll" contains export function called "_Cbuild" at ordinal 1 "ucrtbase.dll" contains export function called "_Cmulcc" at ordinal 2 "ucrtbase.dll" contains export function called "_Cmulcr" at ordinal 3 "ucrtbase.dll" contains export function called "_CreateFrameInfo" at ordinal 4 "ucrtbase.dll" contains export function called "_CxxThrowException" at ordinal 5 "ucrtbase.dll" contains export function called "_Exit" at ordinal 6 "ucrtbase.dll" contains export function called "_FCbuild" at ordinal 7 "ucrtbase.dll" contains export function called "_FCmulcc" at ordinal 8 "ucrtbase.dll" contains export function called "_FCmulcr" at ordinal 9 "ucrtbase.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 10 "ucrtbase.dll" contains export function called "_GetImageBase" at ordinal 11 "ucrtbase.dll" contains export function called "_GetThrowImageBase" at ordinal 12 "ucrtbase.dll" contains export function called "_Getdays" at ordinal 13 "ucrtbase.dll" contains export function called "_Getmonths" at ordinal 14 "ucrtbase.dll" contains export function called "_Gettnames" at ordinal 15 "ucrtbase.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 16 "ucrtbase.dll" contains export function called "_LCbuild" at ordinal 17 "ucrtbase.dll" contains export function called "_LCmulcc" at ordinal 18 "ucrtbase.dll" contains export function called "_LCmulcr" at ordinal 19 "ucrtbase.dll" contains export function called "_SetImageBase" at ordinal 20 "ucrtbase.dll" contains export function called "_SetThrowImageBase" at ordinal 21 "ucrtbase.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 22 "ucrtbase.dll" contains export function called "_Strftime" at ordinal 23 "ucrtbase.dll" contains export function called "_W_Getdays" at ordinal 24 "ucrtbase.dll" contains export function called "_W_Getmonths" at ordinal 2539:T1327,"$reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$hklm_signin = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\SignIn"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$hklm_oem = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\OEM"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$hklm_c2r = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$hklm_lic = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "$regPath = "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Office\16.0"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005252.00000000.118004.26CA0000.00000004.mdmp 00000000-00005252.00000001.119926.26CA0000.00000004.mdmp 00000000-00005252.00000003.128841.26CA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005252.00000000.118004.26F80000.00000004.mdmp 00000000-00005252.00000001.119926.26F80000.00000004.mdmp 00000000-00005252.00000002.121846.26F80000.00000004.mdmp 00000000-00005252.00000003.128841.26F80000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000000.118004.28030000.00000004.mdmp 00000000-00005252.00000000.118004.28170000.00000004.mdmp 00000000-00005252.00000001.119926.28030000.00000004.mdmp 00000000-00005252.00000001.119926.28170000.00000004.mdmp 00000000-00005252.00000001.119926.28B20000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.28030000.00000004.mdmp 00000000-00005252.00000002.121846.28170000.00000004.mdmp 00000000-00005252.00000002.121846.28B20000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.28030000.00000004.mdmp 00000000-00005252.00000003.128841.28B20000.00000004.mdmp "SOFTWARE\Microsoft\Office\ClickToRun\Configuration" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000001.119926.2A760000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.2A760000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.2A760000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000001.119926.28AE0000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.28AE0000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.28AE0000.00000004.mdmp3a:Tb56,Antivirus vendors marked dropped file "setup.exe" as clean (type is "PE32 executable for MS Windows 5.02 (console) Intel i386 5 sections"), Antivirus vendors marked dropped file "ucrtbase.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python37.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "libcrypto-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "tcl86t.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "tk86t.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "cacert.pem" as clean (type is "Unknown"), Antivirus vendors marked dropped file "libssl-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-math-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-string-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-runtime-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-file-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-convert-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-processthreads-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-errorhandling-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-namedpipe-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-process-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections")3b:T1054,"Windows-Office License Management System v2.0.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ucrtbase.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python37.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tcl86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tk86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-crt-math-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-stdio-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-runtime-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-file-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-convert-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-processthreads-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-errorhandling-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-namedpipe-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-process-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-time-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-heap-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-synch-l1-2-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF3c:T3ab3," $reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $hklm_signin = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\SignIn"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $hklm_oem = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\OEM"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $hklm_c2r = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $hklm_lic = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp " $regPath = "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Office\16.0"" in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005252.00000000.118004.26CA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005252.00000000.118004.26F80000.00000004.mdmp ",SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.27C70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Office\ClickToRun\Configuration" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.28030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000000.118004.28130000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000000.118004.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000000.118004.28170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000000.118004.28170000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005252.00000000.118004.69F01000.00000040.mdmp " $reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $hklm_signin = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\SignIn"" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $hklm_oem = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\OEM"" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $hklm_c2r = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $hklm_lic = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp " $regPath = "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Office\16.0"" in Source: 00000000-00005252.00000001.119926.25250000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005252.00000001.119926.26CA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005252.00000001.119926.26F80000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9CB5172B-D600-46BA-AB77-77BB7E3A00D9}" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1765E14E-1BD4-462E-B6B1-590BF1262AC6}" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{6D68D1DE-D432-4B0F-923A-091183A9BDA7}" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00005252.00000001.119926.27C70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000001.119926.28030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000001.119926.28130000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000001.119926.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000001.119926.28170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000001.119926.28170000.00000004.mdmp "5145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00005252.00000001.119926.285EB000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005252.00000001.119926.285EB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005252.00000001.119926.28A60000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000001.119926.28AE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000001.119926.28B20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000001.119926.2A760000.00000004.mdmp " $reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $hklm_signin = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\SignIn"" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $hklm_oem = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\OEM"" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $hklm_c2r = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $hklm_lic = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp " $regPath = "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Office\16.0"" in Source: 00000000-00005252.00000002.121846.25250000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005252.00000002.121846.26F80000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9CB5172B-D600-46BA-AB77-77BB7E3A00D9}" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1765E14E-1BD4-462E-B6B1-590BF1262AC6}" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{6D68D1DE-D432-4B0F-923A-091183A9BDA7}" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00005252.00000002.121846.27C70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000002.121846.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Office\ClickToRun\Configuration" in Source: 00000000-00005252.00000002.121846.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000002.121846.27E70000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000002.121846.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000002.121846.28030000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000002.121846.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000002.121846.28170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000002.121846.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005252.00000002.121846.28320000.00000004.mdmp "5145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00005252.00000002.121846.285EB000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005252.00000002.121846.285EB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005252.00000002.121846.28A60000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000002.121846.28AE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000002.121846.28B20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000002.121846.2A760000.00000004.mdmp " $reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $hklm_signin = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\SignIn"" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $hklm_oem = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\OEM"" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $hklm_c2r = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $hklm_lic = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp " $regPath = "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Office\16.0"" in Source: 00000000-00005252.00000003.128841.25306000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00005252.00000003.128841.26CA0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00005252.00000003.128841.26F80000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9CB5172B-D600-46BA-AB77-77BB7E3A00D9}" in Source: 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1765E14E-1BD4-462E-B6B1-590BF1262AC6}" in Source: 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{6D68D1DE-D432-4B0F-923A-091183A9BDA7}" in Source: 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00005252.00000003.128841.27DA9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance" in Source: 00000000-00005252.00000003.128841.27DA9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00005252.00000003.128841.27DA9000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000003.128841.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Office\ClickToRun\Configuration" in Source: 00000000-00005252.00000003.128841.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000003.128841.27E70000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000003.128841.27E70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000003.128841.28030000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000003.128841.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005252.00000003.128841.28170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005252.00000003.128841.28320000.00000004.mdmp "5145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00005252.00000003.128841.285EB000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005252.00000003.128841.285EB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005252.00000003.128841.28A60000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000003.128841.28AE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005252.00000003.128841.28B20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005252.00000003.128841.2A760000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005252.00000003.128841.69F01000.00000040.mdmp3d:T2005,"OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff93dfc0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9678d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9678d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9678d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "RPCRT4.DLL" at base 7ff9692f0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "NTDLL.DLL" at base 7ff96a210000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff9678d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\UCRTBASE.DLL" at base 7ff93de70000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "KERNEL32.DLL" at base 7ff968e70000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "ADVAPI32.DLL" at base 7ff968db0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-CONIO-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-PROCESS-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "SHLWAPI.DLL" at base 7ff969ed0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "VCRUNTIME140.DLL" at base 7ff95d300000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "VERSION.DLL" at base 7ff95f0d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "WS2_32.DLL" at base 7ff969e60000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\PYTHON37.DLL" at base 7ff93da90000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-PATH-L1-1-0.DLL" at base 7ff9678d0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff966870000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\PYTHON3" at base 7ff954480000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "OLE32.DLL" at base 7ff9683e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "OLEAUT32.DLL" at base 7ff969410000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "PYTHON37.DLL" at base 7ff93da90000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_CTYPES.PYD" at base 7ff9443a0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "KERNEL32" at base 7ff968e70000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_BZ2.PYD" at base 7ff9449e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_LZMA.PYD" at base 7ff944220000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "IPHLPAPI.DLL" at base 7ff966c30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "MSVCRT.DLL" at base 7ff969d60000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "USER32.DLL" at base 7ff969050000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\PYARMOR_RUNTIME_000000\PYARMOR_RUNTIME.PYD" at base 69f00000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 7ff967d30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "NETAPI32.DLL" at base 7ff95cc50000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "USERENV.DLL" at base 7ff967700000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "COMCTL32.DLL" at base 7ff952750000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "COMDLG32.DLL" at base 7ff968f40000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "GDI32.DLL" at base 7ff969020000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "IMM32.DLL" at base 7ff969f30000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "SHELL32.DLL" at base 7ff969590000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "TCL86T.DLL" at base 7ff93d8e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "TK86T.DLL" at base 7ff93d750000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_TKINTER.PYD" at base 7ff944380000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "GDI32" at base 7ff969020000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_SOCKET.PYD" at base 7ff944100000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\SELECT.PYD" at base 7ff954090000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "ADVAPI32" at base 7ff968db0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "BCRYPT.DLL" at base 7ff967eb0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "LIBCRYPTO-1_1.DLL" at base 7ff93d3e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_HASHLIB.PYD" at base 7ff9440e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "CRYPT32.DLL" at base 7ff967bd0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "LIBSSL-1_1.DLL" at base 7ff93d320000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_SSL.PYD" at base 7ff943da0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff966f50000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\_QUEUE.PYD" at base 7ff953cb0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "PYTHON3.DLL" at base 7ff954480000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\CHARSET_NORMALIZER\CD.PYD" at base 7ff93d060000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\CHARSET_NORMALIZER\MD.PYD" at base 7ff942460000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%TEMP%\_MEI59882\UNICODEDATA.PYD" at base 7ff93cf50000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "SHELL32" at base 7ff969590000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff965220000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "UXTHEME.DLL" at base 7ff965220000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "SHCORE" at base 7ff969f60000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "USER32" at base 7ff969050000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff969050000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff969050000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 22627240000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9683e0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff96a0b0000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "DWMAPI" at base 7ff965550000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff95e020000 "OfficeLicenseManagementSystemv2.0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9657300003e:T1648,"Windows-Office License Management System v2.0.exe" was detected as "PyInstaller" and name: "Packer" "Windows-Office License Management System v2.0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Windows-Office License Management System v2.0.exe" was detected as "Microsoft Linker" and name: "Linker" "ucrtbase.dll" was detected as "PyInstaller" and name: "Packer" "ucrtbase.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ucrtbase.dll" was detected as "Microsoft Linker" and name: "Linker" "python37.dll" was detected as "PyInstaller" and name: "Packer" "python37.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python37.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1.dll" was detected as "PyInstaller" and name: "Packer" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "tcl86t.dll" was detected as "PyInstaller" and name: "Packer" "tcl86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tcl86t.dll" was detected as "Microsoft Linker" and name: "Linker" "tk86t.dll" was detected as "PyInstaller" and name: "Packer" "tk86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tk86t.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-1_1.dll" was detected as "PyInstaller" and name: "Packer" "libssl-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "PyInstaller" and name: "Packer" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "PyInstaller" and name: "Packer" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-math-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-string-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-file-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-namedpipe-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-namedpipe-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-namedpipe-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-process-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-time-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-synch-l1-2-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-synch-l1-2-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-synch-l1-2-0.dll" was detected as "Microsoft Linker" and name: "Linker"3f:T1155,Found string "if (-not (Test-Path $hklm_signin)) { New-Item -Path $hklm_signin -Force | Out-Null }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_oem)) { New-Item -Path $hklm_oem -Force | Out-Null }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $hklm_c2r) { Set-ItemProperty -Path $hklm_c2r -Name "UpdatesEnabled" -Value "False" -Type String }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_lic)) { New-Item -Path $hklm_lic -Force | Out-Null }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\FirstRun")) { New-Item -Path "$regPath\FirstRun" -Force | Out-Null }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\Common\General")) { New-Item -Path "$regPath\Common\General" -Force | Out-Null }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path "$regPath\Common\Identity") { Remove-Item -Path "$regPath\Common\Identity" -Recurse -Force }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$licPath1 = Join-Path $dir.FullName "AppData\Local\Microsoft\Office\16.0\Licensing"" (Indicator: "Join-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$licPath2 = Join-Path $dir.FullName "AppData\Local\Microsoft\Office\Licenses"" (Indicator: "Join-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $licPath1) { Remove-Item -Path $licPath1 -Recurse -Force }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $licPath2) { Remove-Item -Path $licPath2 -Recurse -Force }" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path "$env:PROGRAMDATA\Microsoft\Office\Licenses") {" (Indicator: "Test-Path"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")40:T5f1,"Windows-Office License Management System v2.0.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ucrtbase.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-math-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-string-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-stdio-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-runtime-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-file-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-convert-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-processthreads-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-errorhandling-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-namedpipe-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-process-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-time-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-heap-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-synch-l1-2-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"41:T5e2,"Windows-Office License Management System v2.0.exe" has an writable section named ".data" "ucrtbase.dll" has an writable section named ".data" "ucrtbase.dll" has an writable section named ".fptable" "python37.dll" has an writable section named "UPX0" "python37.dll" has an writable section named "UPX1" "python37.dll" has an writable section named ".rsrc" "libcrypto-1_1.dll" has an writable section named "UPX0" "libcrypto-1_1.dll" has an writable section named "UPX1" "libcrypto-1_1.dll" has an writable section named ".rsrc" "tcl86t.dll" has an writable section named "UPX0" "tcl86t.dll" has an writable section named "UPX1" "tcl86t.dll" has an writable section named ".rsrc" "tk86t.dll" has an writable section named "UPX0" "tk86t.dll" has an writable section named "UPX1" "tk86t.dll" has an writable section named ".rsrc" "libssl-1_1.dll" has an writable section named "UPX0" "libssl-1_1.dll" has an writable section named "UPX1" "libssl-1_1.dll" has an writable section named ".rsrc" "VCRUNTIME140.dll" has an writable section named ".data" "api-ms-win-crt-math-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-string-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-stdio-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-runtime-l1-1-0.dll" has an writable section named ".data" "api-ms-win-core-file-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-convert-l1-1-0.dll" has an writable section named ".data"42:T1f0a,"Windows-Office License Management System v2.0.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000b5b0,add rsp, 0x28,jmp 0x14000b1cc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000bb48,test eax, eax,je 0x14000b38e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000b381,cmp rcx, rax,je 0x14000b395,xor eax, eax,lock cmpxchg qword ptr [rip + 0x411ec], rcx,jne 0x14000b37c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000b390,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "ucrtbase.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,cmp edx, 1,je 0x1800616f8,mov r8, rdi,mov edx, ebx,mov rbx, qword ptr [rsp + 0x30],add rsp, 0x20,pop rdi,jmp 0x180024f70,call 0x1800b3b54,jmp 0x1800616e4,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x30,mov eax, dword ptr [rip + 0xd65e7],mov ebx, r8d,mov rdi, rdx,mov rsi, rcx,nop ,test eax, 0x4c0,jne 0x180061743,xor r9d, r9d," "python37.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1803c7401,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x121823],lea rdi, [rsi - 0x2a4000],push rdi,mov eax, 0x3c4d95,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1217f1,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "libcrypto-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18034abac,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0xfb023],lea rdi, [rsi - 0x24e000],push rdi,mov eax, 0x348232,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0xfaffd,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "tcl86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1801a7b71,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x91f93],lea rdi, [rsi - 0x114000],push rdi,mov eax, 0x1a4f93,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x91f60,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "tk86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18016c6cb,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x7cb03],lea rdi, [rsi - 0xee000],push rdi,mov eax, 0x169413,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x7cad5,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "libssl-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1800b0a8b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x29ec3],lea rdi, [rsi - 0x85000],push rdi,mov eax, 0xade9d,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x29e9c,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,cmp edx, 1,jne 0x18000bf59,call 0x18000cc2c,mov r8, rdi,mov edx, ebx,mov rbx, qword ptr [rsp + 0x30],add rsp, 0x20,pop rdi,jmp 0x18000be64,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x4d8,xor r8, r8,xor r9, r9,mov qword ptr [rsp + 0x20], rsp,mov qword ptr [rsp + 0x28], r8,call 0x18000ce70,add rsp, 0x4d8,ret ," "python3.dll" file has an entrypoint instructions - "mov eax, 1,ret ,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al," "api-ms-win-crt-math-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-string-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-stdio-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-runtime-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-file-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-convert-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-processthreads-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-errorhandling-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-namedpipe-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-process-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-time-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-heap-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-synch-l1-2-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al,"43:T588,"Windows-Office License Management System v2.0.exe" has high imagebase "0x140000000" "ucrtbase.dll" has high imagebase "0x180000000" "python37.dll" has high imagebase "0x180000000" "libcrypto-1_1.dll" has high imagebase "0x180000000" "tcl86t.dll" has high imagebase "0x180000000" "tk86t.dll" has high imagebase "0x180000000" "libssl-1_1.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "python3.dll" has high imagebase "0x180000000" "api-ms-win-crt-math-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-string-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-stdio-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-runtime-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-file-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-convert-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-processthreads-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-errorhandling-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-namedpipe-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-process-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-time-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-heap-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-synch-l1-2-0.dll" has high imagebase "0x180000000"44:T74a,Found string "if (-not (Test-Path $hklm_signin)) { New-Item -Path $hklm_signin -Force | Out-Null }" (Indicator: "New-Item "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_oem)) { New-Item -Path $hklm_oem -Force | Out-Null }" (Indicator: "New-Item "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_lic)) { New-Item -Path $hklm_lic -Force | Out-Null }" (Indicator: "New-Item "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\FirstRun")) { New-Item -Path "$regPath\FirstRun" -Force | Out-Null }" (Indicator: "New-Item "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\Common\General")) { New-Item -Path "$regPath\Common\General" -Force | Out-Null }" (Indicator: "New-Item "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")45:T7288,"setup.exe" has type "PE32 executable for MS Windows 5.02 (console) Intel i386 5 sections"- Location: [%TEMP%\_MEI59882\setup.exe]- [targetUID: 00000000-00005988] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI59882\ucrtbase.dll]- [targetUID: 00000000-00005252] "python37.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python37.dll]- [targetUID: 00000000-00005252] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libcrypto-1_1.dll]- [targetUID: 00000000-00005252] "tcl86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tcl86t.dll]- [targetUID: 00000000-00005252] "tk86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tk86t.dll]- [targetUID: 00000000-00005252] "cacert.pem" has type "Unknown"- Location: [%TEMP%\_MEI59882\certifi\cacert.pem]- [targetUID: 00000000-00005988] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libssl-1_1.dll]- [targetUID: 00000000-00005252] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI59882\VCRUNTIME140.dll]- [targetUID: 00000000-00005252] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python3.dll]- [targetUID: 00000000-00005252] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00005988] "sppcplus64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 (stripped to external PDB) 8 sections"- Location: [%TEMP%\_MEI59882\sppcplus64.dll]- [targetUID: 00000000-00005988] "sppcplus32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 (stripped to external PDB) 8 sections"- Location: [%TEMP%\_MEI59882\sppcplus32.dll]- [targetUID: 00000000-00005988] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 1212 method=store"- Location: [%TEMP%\_MEI59882\base_library.zip]- [targetUID: 00000000-00005252] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\unicodedata.pyd]- [targetUID: 00000000-00005252] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%TEMP%\_MEI59882\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00005252] "Roboto-Medium.ttf" has type "Unknown"- Location: [%TEMP%\_MEI59882\customtkinter\assets\fonts\Roboto\Roboto-Medium.ttf]- [targetUID: 00000000-00005252] "Roboto-Regular.ttf" has type "Unknown"- Location: [%TEMP%\_MEI59882\customtkinter\assets\fonts\Roboto\Roboto-Regular.ttf]- [targetUID: 00000000-00005252] "cp936.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp936.enc]- [targetUID: 00000000-00005988] "cp949.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp949.enc]- [targetUID: 00000000-00005988] "clock.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\clock.tcl]- [targetUID: 00000000-00005988] "http-2.9.0.tm" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl8\8.6\http-2.9.0.tm]- [targetUID: 00000000-00005988] "tcltest-2.5.0.tm" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl8\8.5\tcltest-2.5.0.tm]- [targetUID: 00000000-00005988] "euc-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\euc-kr.enc]- [targetUID: 00000000-00005988] "ksc5601.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\ksc5601.enc]- [targetUID: 00000000-00005988] "big5.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\big5.enc]- [targetUID: 00000000-00005988] "cp950.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp950.enc]- [targetUID: 00000000-00005988] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_lzma.pyd]- [targetUID: 00000000-00005252] "gb12345.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\gb12345.enc]- [targetUID: 00000000-00005988] "gb2312.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\gb2312.enc]- [targetUID: 00000000-00005988] "gb2312-raw.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\gb2312-raw.enc]- [targetUID: 00000000-00005988] "euc-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\euc-jp.enc]- [targetUID: 00000000-00005988] "jis0208.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\jis0208.enc]- [targetUID: 00000000-00005988] "icon.ico" has type "MS Windows icon resource - 4 icons 16x16 with PNG image data 16 x 16 8-bit/color RGBA non-interlaced 32 bits/pixel 32x32 with \012- PNG image data 32 x 32 8-bit/color RGBA non-interlaced 32 bits/pixel"- Location: [%TEMP%\_MEI59882\icon.ico]- [targetUID: 00000000-00005252] "jis0212.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\jis0212.enc]- [targetUID: 00000000-00005988] "md.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\charset_normalizer\md.pyd]- [targetUID: 00000000-00005252] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_ctypes.pyd]- [targetUID: 00000000-00005252] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_ssl.pyd]- [targetUID: 00000000-00005252] "cd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\charset_normalizer\cd.pyd]- [targetUID: 00000000-00005252] "cp932.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp932.enc]- [targetUID: 00000000-00005988] "macJapan.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macJapan.enc]- [targetUID: 00000000-00005988] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_bz2.pyd]- [targetUID: 00000000-00005252] "shiftjis.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\shiftjis.enc]- [targetUID: 00000000-00005988] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_socket.pyd]- [targetUID: 00000000-00005252] "_tkinter.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_tkinter.pyd]- [targetUID: 00000000-00005252] "msgcat-1.6.1.tm" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl8\8.5\msgcat-1.6.1.tm]- [targetUID: 00000000-00005252] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_hashlib.pyd]- [targetUID: 00000000-00005252] "init.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\init.tcl]- [targetUID: 00000000-00005252] "auto.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\auto.tcl]- [targetUID: 00000000-00005252] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_queue.pyd]- [targetUID: 00000000-00005252] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\select.pyd]- [targetUID: 00000000-00005252] "CustomTkinter_icon_Windows.ico" has type "MS Windows icon resource - 1 icon 256x256 with PNG image data 256 x 256 8-bit/color RGBA non-interlaced 32 bits/pixel"- Location: [%TEMP%\_MEI59882\customtkinter\assets\icons\CustomTkinter_icon_Windows.ico]- [targetUID: 00000000-00005988] "platform-1.0.14.tm" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl8\8.4\platform-1.0.14.tm]- [targetUID: 00000000-00005988] "http.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\http1.0\http.tcl]- [targetUID: 00000000-00005988] "history.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\history.tcl]- [targetUID: 00000000-00005988] ".DS_Store" has type "Unknown"- Location: [%TEMP%\_MEI59882\customtkinter\assets\icons\.DS_Store]- [targetUID: 00000000-00005988] ".DS_Store" has type "Unknown"- Location: [%TEMP%\_MEI59882\customtkinter\assets\.DS_Store]- [targetUID: 00000000-00005988] "shell-1.1.4.tm" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl8\8.4\platform\shell-1.1.4.tm]- [targetUID: 00000000-00005988] "blue.json" has type "JSON text data"- Location: [%TEMP%\_MEI59882\customtkinter\assets\themes\blue.json]- [targetUID: 00000000-00005252] "green.json" has type "JSON text data"- Location: [%TEMP%\_MEI59882\customtkinter\assets\themes\green.json]- [targetUID: 00000000-00005988] "dark-blue.json" has type "JSON text data"- Location: [%TEMP%\_MEI59882\customtkinter\assets\themes\dark-blue.json]- [targetUID: 00000000-00005988] "CustomTkinter_shapes_font.otf" has type "Unknown"- Location: [%TEMP%\_MEI59882\customtkinter\assets\fonts\CustomTkinter_shapes_font.otf]- [targetUID: 00000000-00005252] "bn.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\bn.msg]- [targetUID: 00000000-00005988] "el.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\el.msg]- [targetUID: 00000000-00005988] "be.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\be.msg]- [targetUID: 00000000-00005988] "ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ar.msg]- [targetUID: 00000000-00005988] "bg.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\bg.msg]- [targetUID: 00000000-00005988] "ar_jo.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ar_jo.msg]- [targetUID: 00000000-00005988] "ar_lb.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ar_lb.msg]- [targetUID: 00000000-00005988] "ar_sy.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ar_sy.msg]- [targetUID: 00000000-00005988] "cs.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\cs.msg]- [targetUID: 00000000-00005988] "eo.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\eo.msg]- [targetUID: 00000000-00005988] "de_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\de_be.msg]- [targetUID: 00000000-00005988] "de.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\de.msg]- [targetUID: 00000000-00005988] "es.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\es.msg]- [targetUID: 00000000-00005988] "da.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\da.msg]- [targetUID: 00000000-00005988] "ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ca.msg]- [targetUID: 00000000-00005988] "macDingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macDingbats.enc]- [targetUID: 00000000-00005988] "macCyrillic.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macCyrillic.enc]- [targetUID: 00000000-00005988] "macCentEuro.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macCentEuro.enc]- [targetUID: 00000000-00005988] "macCroatian.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macCroatian.enc]- [targetUID: 00000000-00005988] "macIceland.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macIceland.enc]- [targetUID: 00000000-00005988] "iso8859-16.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-16.enc]- [targetUID: 00000000-00005988] "iso8859-14.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-14.enc]- [targetUID: 00000000-00005988] "iso8859-13.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-13.enc]- [targetUID: 00000000-00005988] "iso8859-10.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-10.enc]- [targetUID: 00000000-00005988] "macTurkish.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macTurkish.enc]- [targetUID: 00000000-00005988] "macRomania.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macRomania.enc]- [targetUID: 00000000-00005988] "iso8859-15.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-15.enc]- [targetUID: 00000000-00005988] "macUkraine.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macUkraine.enc]- [targetUID: 00000000-00005988] "iso8859-1.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-1.enc]- [targetUID: 00000000-00005988] "iso8859-5.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-5.enc]- [targetUID: 00000000-00005988] "iso8859-8.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-8.enc]- [targetUID: 00000000-00005988] "iso8859-3.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-3.enc]- [targetUID: 00000000-00005988] "iso8859-9.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-9.enc]- [targetUID: 00000000-00005988] "iso8859-7.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-7.enc]- [targetUID: 00000000-00005988] "iso8859-6.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-6.enc]- [targetUID: 00000000-00005988] "iso8859-2.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-2.enc]- [targetUID: 00000000-00005988] "iso8859-4.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso8859-4.enc]- [targetUID: 00000000-00005988] "macGreek.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macGreek.enc]- [targetUID: 00000000-00005988] "dingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\dingbats.enc]- [targetUID: 00000000-00005988] "macRoman.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macRoman.enc]- [targetUID: 00000000-00005988] "macThai.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\macThai.enc]- [targetUID: 00000000-00005988] "jis0201.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\jis0201.enc]- [targetUID: 00000000-00005988] "cp1256.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1256.enc]- [targetUID: 00000000-00005988] "cp1254.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1254.enc]- [targetUID: 00000000-00005988] "cp1252.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1252.enc]- [targetUID: 00000000-00005252] "symbol.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\symbol.enc]- [targetUID: 00000000-00005252] "cp1250.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1250.enc]- [targetUID: 00000000-00005988] "cp1258.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1258.enc]- [targetUID: 00000000-00005988] "cp1251.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1251.enc]- [targetUID: 00000000-00005988] "cp1253.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1253.enc]- [targetUID: 00000000-00005988] "cp1257.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1257.enc]- [targetUID: 00000000-00005988] "koi8-r.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\koi8-r.enc]- [targetUID: 00000000-00005988] "tis-620.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\tis-620.enc]- [targetUID: 00000000-00005988] "cp1255.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp1255.enc]- [targetUID: 00000000-00005988] "koi8-u.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\koi8-u.enc]- [targetUID: 00000000-00005988] "gb1988.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\gb1988.enc]- [targetUID: 00000000-00005988] "ascii.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\ascii.enc]- [targetUID: 00000000-00005988] "cp855.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp855.enc]- [targetUID: 00000000-00005988] "cp862.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp862.enc]- [targetUID: 00000000-00005988] "cp864.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp864.enc]- [targetUID: 00000000-00005988] "cp860.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp860.enc]- [targetUID: 00000000-00005988] "cp874.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp874.enc]- [targetUID: 00000000-00005988] "cp863.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp863.enc]- [targetUID: 00000000-00005988] "cp861.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp861.enc]- [targetUID: 00000000-00005988] "cp437.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp437.enc]- [targetUID: 00000000-00005988] "cp857.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp857.enc]- [targetUID: 00000000-00005988] "cp865.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp865.enc]- [targetUID: 00000000-00005988] "cp737.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp737.enc]- [targetUID: 00000000-00005988] "cp852.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp852.enc]- [targetUID: 00000000-00005988] "cp866.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp866.enc]- [targetUID: 00000000-00005988] "cp775.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp775.enc]- [targetUID: 00000000-00005988] "cp869.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp869.enc]- [targetUID: 00000000-00005988] "cp850.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\cp850.enc]- [targetUID: 00000000-00005988] "ebcdic.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\ebcdic.enc]- [targetUID: 00000000-00005988] "af.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\af.msg]- [targetUID: 00000000-00005988] "de_at.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\de_at.msg]- [targetUID: 00000000-00005988] "pkgIndex.tcl" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\http1.0\pkgIndex.tcl]- [targetUID: 00000000-00005252] "en_ph.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_ph.msg]- [targetUID: 00000000-00005988] "en_hk.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_hk.msg]- [targetUID: 00000000-00005988] "en_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_in.msg]- [targetUID: 00000000-00005988] "en_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_be.msg]- [targetUID: 00000000-00005988] "en_au.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_au.msg]- [targetUID: 00000000-00005988] "en_nz.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_nz.msg]- [targetUID: 00000000-00005988] "en_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_ca.msg]- [targetUID: 00000000-00005988] "en_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_gb.msg]- [targetUID: 00000000-00005988] "en_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_ie.msg]- [targetUID: 00000000-00005988] "bn_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\bn_in.msg]- [targetUID: 00000000-00005988] "ar_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\ar_in.msg]- [targetUID: 00000000-00005988] "af_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\af_za.msg]- [targetUID: 00000000-00005988] "en_zw.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_zw.msg]- [targetUID: 00000000-00005988] "en_sg.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_sg.msg]- [targetUID: 00000000-00005988] "en_bw.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_bw.msg]- [targetUID: 00000000-00005988] "en_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\msgs\en_za.msg]- [targetUID: 00000000-00005988] "iso2022.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso2022.enc]- [targetUID: 00000000-00005988] "iso2022-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso2022-jp.enc]- [targetUID: 00000000-00005988] "iso2022-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\iso2022-kr.enc]- [targetUID: 00000000-00005988] "euc-cn.enc" has type "Unknown"- Location: [%TEMP%\_MEI59882\tcl\encoding\euc-cn.enc]- [targetUID: 00000000-00005988]46:T885,"OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINDOWS-OFFICELICENSEMANAGEMENTSYSTEMV2.0.EXE"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "")47:T12f2,"ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI59882\ucrtbase.dll]- [targetUID: 00000000-00005252] "python37.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python37.dll]- [targetUID: 00000000-00005252] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libcrypto-1_1.dll]- [targetUID: 00000000-00005252] "tcl86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tcl86t.dll]- [targetUID: 00000000-00005252] "tk86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tk86t.dll]- [targetUID: 00000000-00005252] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libssl-1_1.dll]- [targetUID: 00000000-00005252] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI59882\VCRUNTIME140.dll]- [targetUID: 00000000-00005252] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python3.dll]- [targetUID: 00000000-00005252] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00005988]48:Tec2,"OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WINDOWS-OFFICELICENSEMANAGEMENTSYSTEMV2.0"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "")49:T44c,"OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\Windows\System32\imm32.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "\Device\KsecDD" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\FLTLIB.DLL" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL"4a:Tb31,"OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\VCRUNTIME140.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-console-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-datetime-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-debug-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-fibers-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-fibers-l1-1-1.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l1-2-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l2-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-handle-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-heap-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-interlocked-l1-1-0.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-libraryloader-l1-1-0.dll"4b:Te03,"OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_bz2.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_ctypes.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_hashlib.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_lzma.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_queue.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_socket.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_ssl.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_tkinter.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer\cd.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer\md.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\pyarmor_runtime_000000" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\pyarmor_runtime_000000\pyarmor_runtime.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\select.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\unicodedata.pyd" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\base_library.zip" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\certifi" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\certifi\cacert.pem" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\certifi\py.typed" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\.DS_Store" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\fonts" "OfficeLicenseManagementSystemv2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\customtkinter\assets\fonts\CustomTkinter_shapes_font.otf"4c:T63eb,"OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\_tkinter.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-console-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-datetime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-debug-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-fibers-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-fibers-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-file-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-handle-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-interlocked-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-libraryloader-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-localization-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-memory-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-namedpipe-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-processenvironment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-processthreads-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-processthreads-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-profile-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-rtlsupport-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-synch-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-synch-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-sysinfo-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-sysinfo-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-timezone-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-core-util-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-conio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-process-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer\cd.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\charset_normalizer\md.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\libcrypto-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\libssl-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\pyarmor_runtime_000000\pyarmor_runtime.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\python3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OfficeLicenseManagementSystemv2.0.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI59882\python37.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4d:T23b8,file/memory contains long string with (Indicator: " socket "; File: "http.tcl") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "Windows-Office License Management System v2.0.exe") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.26E10000.00000004.mdmp, 00000000-00005252.00000001.119926.26E10000.00000004.mdmp, 00000000-00005252.00000003.128841.26E10000.00000004.mdmp") Found reference to API "This module allows you to spawn processes, connect to their" (Indicator: " connect "; Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found reference to API "replace the previous function. See bind for the return value." (Indicator: " bind "; Source: "00000000-00005252.00000000.118004.27C30000.00000004.mdmp, 00000000-00005252.00000002.121846.27C30000.00000004.mdmp, 00000000-00005252.00000003.128841.27C30000.00000004.mdmp") Found reference to API "gethostnamer" (Indicator: "gethostname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found reference to API "The socket must be of SOCK_STREAM type." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "This module provides socket operations and some related functions." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "socket are available as methods of the socket object." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "socket() -- create a new socket object" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "socketpair() -- create a pair of new socket objects [*]" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "fromfd() -- create a socket object from an open file descriptor [*]" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "fromshare() -- create a socket object from data received from socket.share() [*]" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "gethostname() -- return the current hostname" (Indicator: "gethostname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "gethostbyname() -- map a hostname to its IP number" (Indicator: "gethostbyname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "inet_ntoa() -- convert 32-bit packed format IP to string (123.45.67.89)" (Indicator: "inet_ntoa"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "SocketType -- type object for socket objects" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "AF_INET, AF_UNIX -- socket domains (first argument to socket() call)" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "SOCK_STREAM, SOCK_DGRAM, SOCK_RAW -- socket types (second argument)" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "all the necessary arguments for creating a socket connected to that service." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found reference to API "socket(family=AF_INET, type=SOCK_STREAM, proto=0) -> socket object" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp") Found reference to API "socket(family=-1, type=-1, proto=-1, fileno=None) -> socket object" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp") Found reference to API "Open a socket of the given type. The family argument specifies the" (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp") Found reference to API "The socket is created as non-inheritable." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp") Found reference to API "A socket object represents one endpoint of a network connection." (Indicator: " socket "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp")4e:T1514c,Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp") Found URL "http://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00005252.00000000.118004.27190000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000000.118004.27C30000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000000.118004.27C30000.00000004.mdmp") Found URL "https://download.erdemcastle.com/updates/wolicensemanagementsystem/version.jsonget" - Source: "00000000-00005252.00000000.118004.27C30000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html" - Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found URL "http://json.org>" - Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html" - Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp") Found URL "https://kms.erdemcastle.comrenkli_yildizlaranimasyon_dongusubtn_win_to_officebtn_office_to_winwindows" - Source: "00000000-00005252.00000000.118004.27FB0000.00000004.mdmp") Found URL "http://www.python.org/dev/peps/pep-0205/)?,u" - Source: "00000000-00005252.00000000.118004.280F0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309" - Source: "00000000-00005252.00000000.118004.28130000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00005252.00000000.118004.28240000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000000.118004.28240000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000000.118004.28240000.00000004.mdmp") Found URL "http://head" - Source: "00000000-00005252.00000000.118004.69F01000.00000040.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000001.119926.25250000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000001.119926.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000001.119926.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000001.119926.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00005252.00000001.119926.26F80000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000001.119926.27090000.00000004.mdmp") Found URL "http://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00005252.00000001.119926.27190000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://json.org>" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://google.com/mail/'))" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "http://www.python.org/')quoted-printable" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/" - Source: "00000000-00005252.00000001.119926.27C70000.00000004.mdmp") Found URL "https://kms.erdemcastle.comrenkli_yildizlaranimasyon_dongusubtn_win_to_officebtn_office_to_winwindows" - Source: "00000000-00005252.00000001.119926.27FB0000.00000004.mdmp") Found URL "http://www.python.org/dev/peps/pep-0205/)?,u" - Source: "00000000-00005252.00000001.119926.280F0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309" - Source: "00000000-00005252.00000001.119926.28130000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00005252.00000001.119926.28240000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000001.119926.28240000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000001.119926.28240000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000001.119926.28360000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000001.119926.28360000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000001.119926.28360000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00005252.00000001.119926.28360000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000001.119926.28360000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00005252.00000001.119926.28760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00005252.00000001.119926.287A0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539" - Source: "00000000-00005252.00000001.119926.287A0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000001.119926.28820000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00005252.00000001.119926.28820000.00000004.mdmp") Found URL "https://getaddrinfo" - Source: "00000000-00005252.00000001.119926.28860000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000001.119926.28860000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00005252.00000001.119926.288A0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00005252.00000001.119926.28930000.00000004.mdmp") Found URL "https://requests.readthedocs.ioimportlib.resourcesme@kennethreitz.orgcopyright" - Source: "00000000-00005252.00000001.119926.28AA0000.00000004.mdmp") Found URL "https://http://mountpreparemerged_cookiesprepare_requestprepsend_kwargssession.requestsession.getsession.optionssession.headsession.postsession.putsession.patchsession.deletefz(&econdsm+upget_adapterpreferred_clock" - Source: "00000000-00005252.00000001.119926.28AE0000.00000004.mdmp") Found URL "https://__attrs__te__.!ctkcanvas33192requestserrorerrorx4*%&om_urlgauthbaseadapterell__max_retries_pool_maxsize_pool_blockdefault_retriesproxy_managerpool_maxsizerequests\adapters.pythe" - Source: "00000000-00005252.00000001.119926.28AE0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/contrib.html" - Source: "00000000-00005252.00000001.119926.28AE0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000001.119926.28B20000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00005252.00000001.119926.3D3D1000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00005252.00000001.119926.3D72B000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000002.121846.25250000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000002.121846.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000002.121846.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000002.121846.25250000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00005252.00000002.121846.26F80000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000002.121846.27090000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000002.121846.27C30000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000002.121846.27C30000.00000004.mdmp") Found URL "https://download.erdemcastle.com/updates/wolicensemanagementsystem/version.jsonget" - Source: "00000000-00005252.00000002.121846.27C30000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://json.org>" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://google.com/mail/'))" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "http://www.python.org/')quoted-printable" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/" - Source: "00000000-00005252.00000002.121846.27C70000.00000004.mdmp") Found URL "https://kms.erdemcastle.comrenkli_yildizlaranimasyon_dongusubtn_win_to_officebtn_office_to_winwindows" - Source: "00000000-00005252.00000002.121846.27FB0000.00000004.mdmp") Found URL "http://www.python.org/dev/peps/pep-0205/)?,u" - Source: "00000000-00005252.00000002.121846.280F0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00005252.00000002.121846.28240000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000002.121846.28240000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000002.121846.28240000.00000004.mdmp") Found URL "http://https://" - Source: "00000000-00005252.00000002.121846.28320000.00000004.mdmp") Found URL "http://p4(&<3(&=3(&error" - Source: "00000000-00005252.00000002.121846.28320000.00000004.mdmp") Found URL "https://_localhosteadersnoheadersrefcount_noheaderskeepalivebusyrapper.initretr" - Source: "00000000-00005252.00000002.121846.28320000.00000004.mdmp") Found URL "http://%spcz(&proxyenableproxyserverproxyoverridep://%sproxyoverriderawhosthttps://%sftp://%s(2(&04(&:4(&urllib.responseurllibp=4(&pv*(&x4*%&h=4(&fqdnoverridehttp.clienturllib.errorproxyenableproxyserver(?:[^/:]+)://%s://%sequest>4(&0*%&httpencoderspx0(&>4(&0*/(&x4*%&base64mimeiteratorsfeedparsermimequoprimimeparseremail.parserparsestrbytesparserparsebytesp%5(&[^:\s][^:\r\n]*(n4(&d4(&pd4(&e4(&pe4(&e4(&0f4(&32(&f4(&22(&f4(&22(&pg4(&032(&g4(&p32(&h4(&p32(&r4(&32(&ph4(&32(&h4(&32(&0i4(&32(&i4(&42(&i4(&042(&" - Source: "00000000-00005252.00000002.121846.28320000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000002.121846.28360000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000002.121846.28360000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000002.121846.28360000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00005252.00000002.121846.28360000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000002.121846.28360000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00005252.00000002.121846.28760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00005252.00000002.121846.287A0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539" - Source: "00000000-00005252.00000002.121846.287A0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000002.121846.28820000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00005252.00000002.121846.28820000.00000004.mdmp") Found URL "https://getaddrinfo" - Source: "00000000-00005252.00000002.121846.28860000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000002.121846.28860000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00005252.00000002.121846.288A0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00005252.00000002.121846.288F0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00005252.00000002.121846.288F0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00005252.00000002.121846.288F0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920k" - Source: "00000000-00005252.00000002.121846.288F0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00005252.00000002.121846.28930000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00005252.00000002.121846.28970000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000002.121846.289D0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00005252.00000002.121846.28A20000.00000004.mdmp") Found URL "https://requests.readthedocs.ioimportlib.resourcesme@kennethreitz.orgcopyright" - Source: "00000000-00005252.00000002.121846.28AA0000.00000004.mdmp") Found URL "https://http://mountpreparemerged_cookiesprepare_requestprepsend_kwargssession.requestsession.getsession.optionssession.headsession.postsession.putsession.patchsession.deletefz(&econdsm+upget_adapterpreferred_clock" - Source: "00000000-00005252.00000002.121846.28AE0000.00000004.mdmp") Found URL "https://__attrs__te__.!ctkcanvas33192requestserrorerrorx4*%&om_urlgauthbaseadapterell__max_retries_pool_maxsize_pool_blockdefault_retriesproxy_managerpool_maxsizerequests\adapters.pythe" - Source: "00000000-00005252.00000002.121846.28AE0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/contrib.html" - Source: "00000000-00005252.00000002.121846.28AE0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000002.121846.28B20000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00005252.00000002.121846.3CF51000.00000040.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00005252.00000003.128841.26F80000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found URL "http://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00005252.00000003.128841.27190000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000003.128841.27C30000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000003.128841.27C30000.00000004.mdmp") Found URL "https://download.erdemcastle.com/updates/wolicensemanagementsystem/version.jsonget" - Source: "00000000-00005252.00000003.128841.27C30000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "http://json.org>" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found URL "https://github.com/ousret/charset_normalizer>.:copyright:" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "http://google.com/mail/'))" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "http://www.python.org/')quoted-printable" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://localhost:3128/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://httpbin.org/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://twitter.com/" - Source: "00000000-00005252.00000003.128841.27DA9000.00000004.mdmp") Found URL "https://kms.erdemcastle.comrenkli_yildizlaranimasyon_dongusubtn_win_to_officebtn_office_to_winwindows" - Source: "00000000-00005252.00000003.128841.27FB0000.00000004.mdmp") Found URL "http://www.python.org/dev/peps/pep-0205/)?,u" - Source: "00000000-00005252.00000003.128841.280F0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309" - Source: "00000000-00005252.00000003.128841.28130000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00005252.00000003.128841.28240000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666" - Source: "00000000-00005252.00000003.128841.28240000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwmwindowattribute" - Source: "00000000-00005252.00000003.128841.28240000.00000004.mdmp") Found URL "http://https://" - Source: "00000000-00005252.00000003.128841.28320000.00000004.mdmp") Found URL "http://p4(&<3(&=3(&error" - Source: "00000000-00005252.00000003.128841.28320000.00000004.mdmp") Found URL "https://pi4(&b4(&_localhostb4(&a4(&eaders0b4(&0e4(&noheaderspe4(&refcountj4(&_noheaders0k4(&keepalivepd4(&i4(&busyi4(&rapper.inith4(&f4(&retr" - Source: "00000000-00005252.00000003.128841.28320000.00000004.mdmp") Found URL "http://%spcz(&proxyenableproxyserverproxyoverridep://%sproxyoverriderawhosthttps://%sftp://%s(2(&04(&:4(&urllib.responseurllibx4*%&fqdnoverridehttp.clienturllib.errorproxyenableproxyserver(?:[^/:]+)://%s://%sequest>4(&0*%&httpencodersx4*%&base64mimeiteratorsfeedparsermimequoprimimeparseremail.parserparsestrbytesparserparsebytes0v(&[^:\s][^:\r\n]*(n4(&d4(&pd4(&e4(&pe4(&e4(&0f4(&f4(&f4(&pg4(&g4(&h4(&r4(&ph4(&h4(&0i4(&i4(&i4(&" - Source: "00000000-00005252.00000003.128841.28320000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00005252.00000003.128841.28360000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00005252.00000003.128841.28360000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00005252.00000003.128841.28360000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00005252.00000003.128841.28360000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000003.128841.284D1000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00005252.00000003.128841.28760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00005252.00000003.128841.287A0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539" - Source: "00000000-00005252.00000003.128841.287A0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000003.128841.28820000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00005252.00000003.128841.28820000.00000004.mdmp") Found URL "https://getaddrinfo" - Source: "00000000-00005252.00000003.128841.28860000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00005252.00000003.128841.28860000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00005252.00000003.128841.288A0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00005252.00000003.128841.288F0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00005252.00000003.128841.288F0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00005252.00000003.128841.288F0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920k" - Source: "00000000-00005252.00000003.128841.288F0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00005252.00000003.128841.28930000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00005252.00000003.128841.28970000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000003.128841.289D0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00005252.00000003.128841.28A20000.00000004.mdmp") Found URL "https://requests.readthedocs.ioimportlib.resourcesme@kennethreitz.orgcopyright" - Source: "00000000-00005252.00000003.128841.28AA0000.00000004.mdmp") Found URL "https://http://mountpreparemerged_cookiesprepare_requestprepsend_kwargssession.requestsession.getsession.optionssession.headsession.postsession.putsession.patchsession.deletefz(&econdsm+upget_adapterpreferred_clock" - Source: "00000000-00005252.00000003.128841.28AE0000.00000004.mdmp") Found URL "https://__attrs__te__.!ctkcanvas33192requestserrorerrorx4*%&om_urlgauthbaseadapterell__max_retries_pool_maxsize_pool_blockdefault_retriesproxy_managerpool_maxsizerequests\adapters.pythe" - Source: "00000000-00005252.00000003.128841.28AE0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/contrib.html" - Source: "00000000-00005252.00000003.128841.28AE0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00005252.00000003.128841.28B20000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00005252.00000003.128841.3CF51000.00000040.mdmp") Found URL "http://head" - Source: "00000000-00005252.00000003.128841.69F01000.00000040.mdmp") Found URL "https://erde;com/wolicensemanagementsystem/0g>ehs" - Source: "00000000-00005988.00000000.117541.9CC50000.00000004.mdmp") Found URL "http://crlkxxgmt=+luj" - Source: "00000000-00005988.00000000.117541.9CC50000.00000004.mdmp") Found URL "http://crlkxxgmt=+lumstructmpyimod01_archivempyimod02_importersmpyimod03_ctypesmpyimod04_pywin32spyiboot01_bootstrapspyi_rth_inspectspyi_rth__tkintersactivationbvcruntime140.dllb_bz2.pydb_ctypes.pydb_hashlib.pydb_lzma.pydb_queue.pydb_socket.pydb_ssl.pydb_tkinter.pydbapi-ms-win-core-console-l1-1-0.dllbapi-ms-win-core-datetime-l1-1-0.dllbapi-ms-win-core-debug-l1-1-0.dllbapi-ms-win-core-errorhandling-l1-1-0.dllbapi-ms-win-core-fibers-l1-1-0.dllbapi-ms-win-core-fibers-l1-1-1.dllbapi-ms-win-core-file-l1-1-0.dllbapi-ms-win-core-file-l1-2-0.dllbapi-ms-win-core-file-l2-1-0.dllbapi-ms-win-core-handle-l1-1-0.dllbapi-ms-win-core-heap-l1-1-0.dllbapi-ms-win-core-interlocked-l1-1-0.dllbapi-ms-win-core-kernel32-legacy-l1-1-1.dllbapi-ms-win-core-libraryloader-l1-1-0.dllbapi-ms-win-core-localization-l1-2-0.dllbapi-ms-win-core-memory-l1-1-0.dllbapi-ms-win-core-namedpipe-l1-1-0.dllbapi-ms-win-core-processenvironment-l1-1-0.dllbapi-ms-win-core-processthreads-l1-1-0.dllbapi-ms-win-core-processthreads-l1-1-1.dllbapi-ms-win-core-profile-l1-1-0.dllbapi-ms-win-core-rtlsupport-l1-1-0.dllbapi-ms-win-core-string-l1-1-0.dllbapi-ms-win-core-synch-l1-1-0.dllbapi-ms-win-core-synch-l1-2-0.dllbapi-ms-win-core-sysinfo-l1-1-0.dllbapi-ms-win-core-sysinfo-l1-2-0.dllbapi-ms-win-core-timezone-l1-1-0.dllbapi-ms-win-core-util-l1-1-0.dllbapi-ms-win-crt-conio-l1-1-0.dllbapi-ms-win-crt-convert-l1-1-0.dllbapi-ms-win-crt-environment-l1-1-0.dllbapi-ms-win-crt-filesystem-l1-1-0.dllbapi-ms-win-crt-heap-l1-1-0.dllbapi-ms-win-crt-locale-l1-1-0.dllbapi-ms-win-crt-math-l1-1-0.dllbapi-ms-win-crt-process-l1-1-0.dllbapi-ms-win-crt-runtime-l1-1-0.dllbapi-ms-win-crt-stdio-l1-1-0.dllbapi-ms-win-crt-string-l1-1-0.dllbapi-ms-win-crt-time-l1-1-0.dllbapi-ms-win-crt-utility-l1-1-0.dllbcharset_normalizer\cd.pydbcharset_normalizer\md.pydblibcrypto-1_1.dllblibssl-1_1.dllbpyarmor_runtime_000000\pyarmor_runtime.pydbpython3.dllbpython37.dllbselect.pydbtcl86t.dllbtk86t.dllbucrtbase.dllbunicodedata.pydxbase_library.zipxcertifi\cacert.pemxcertifi\py.typedxcustomtkinter\assets\.ds_storexcustomtkinter\assets\fonts\customtkinter_shapes_font.otfxcustomtkinter\assets\fonts\roboto\roboto-medium.ttfxcustomtkinter\assets\fonts\roboto\roboto-regular.ttfxcustomtkinter\assets\icons\.ds_storexcustomtkinter\assets\icons\customtkinter_icon_windows.icoxcustomtkinter\assets\themes\blue.jsonxcustomtkinter\assets\themes\dark-blue.jsonxcustomtkinter\assets\themes\green.jsonxicon.icoxsetup.exexsppcplus32.dllxsppcplus64.dllxtcl8\8.4\platform-1.0.14.tmxtcl8\8.4\platform\shell-1.1.4.tmxtcl8\8.5\msgcat-1.6.1.tmxtcl8\8.5\tcltest-2.5.0.tmxtcl8\8.6\http-2.9.0.tmxtcl\auto.tclxtcl\clock.tclxtcl\encoding\ascii.encxtcl\encoding\big5.encxtcl\encoding\cp1250.encxtcl\encoding\cp1251.encxtcl\encoding\cp1252.encxtcl\encoding\cp1253.encxtcl\encoding\cp1254.encxtcl\encoding\cp1255.encxtcl\encoding\cp1256.encxtcl\encoding\cp1257.encxtcl\encoding\cp1258.encxtcl\encoding\cp437.encxtcl\encoding\cp737.encxtcl\encoding\cp775.encxtcl\encoding\cp850.encxtcl\encoding\cp852.encxtcl\encoding\cp855.encxtcl\encoding\cp857.encxtcl\encoding\cp860.encxtcl\encoding\cp861.encxtcl\encoding\cp862.encxtcl\encoding\cp863.encxtcl\encoding\cp864.encxtcl\encoding\cp865.encxtcl\encoding\cp866.encxtcl\encoding\cp869.encxtcl\encoding\cp874.encxtcl\encoding\cp932.encxtcl\encoding\cp936.encxtcl\encoding\cp949.encxtcl\encoding\cp950.encxtcl\encoding\dingbats.encxtcl\encoding\ebcdic.encxtcl\encoding\euc-cn.encxtcl\encoding\euc-jp.encxtcl\encoding\euc-kr.encxtcl\encoding\gb12345.encxtcl\encoding\gb1988.encxtcl\encoding\gb2312-raw.encxtcl\encoding\gb2312.encxtcl\encoding\iso2022-jp.encxtcl\encoding\iso2022-kr.encxtcl\encoding\iso2022.encxtcl\encoding\iso8859-1.encxtcl\encoding\iso8859-10.encxtcl\encoding\iso8859-13.encxtcl\encoding\iso8859-14.encxtcl\encoding\iso8859-15.encxtcl\encoding\iso8859-16.encxtcl\encoding\iso8859-2.encxtcl\encoding\iso8859-3.encxtcl\encoding\iso8859-4.encxtcl\encoding\iso8859-5.encxtcl\encoding\iso8859-6.encxtcl\encoding\iso8859-7.encxtcl\encoding\iso8859-8.encxtcl\encoding\iso8859-9.encxtcl\encoding\jis0201.encxtcl\encoding\jis0208.encxtcl\encoding\jis0212.encxtcl\encoding\koi8-r.encxtcl\encoding\koi8-u.encxtcl\encoding\ksc5601.encxtcl\encoding\maccenteuro.encxtcl\encoding\maccroatian.encxtcl\encoding\maccyrillic.encxtcl\encoding\macdingbats.encxtcl\encoding\macgreek.encxtcl\encoding\maciceland.encxtcl\encoding\macjapan.encxtcl\encoding\macroman.encxtcl\encoding\macromania.encxtcl\encoding\macthai.encxtcl\encoding\macturkish.encxtcl\encoding\macukraine.encxtcl\encoding\shiftjis.encxtcl\encoding\symbol.encxtcl\encoding\tis-620.encxtcl\history.tclxtcl\http1.0\http.tclxtcl\http1.0\pkgindex.tclxtcl\init.tclxtcl\msgs\af.msgxtcl\msgs\af_za.msgxtcl\msgs\ar.msgxtcl\msgs\ar_in.msgxtcl\msgs\ar_jo.msgxtcl\msgs\ar_lb.msgxtcl\msgs\ar_sy.msgxtcl\msgs\be.msgxtcl\msgs\bg.msgxtcl\msgs\bn.msgxtcl\msgs\bn_in.msgxtcl\msgs\ca.msgxtcl\msgs\cs.msgxtcl\msgs\da.msgxtcl\msgs\de.msgxtcl\msgs\de_at.msgxtcl\msgs\de_be.msgxtcl\msgs\el.msgxtcl\msgs\en_au.msgxtcl\msgs\en_be.msgxtcl\msgs\en_bw.msgxtcl\msgs\en_ca.msgxtcl\msgs\en_gb.msgxtcl\msgs\en_hk.msgxtcl\msgs\en_ie.msgxtcl\msgs\en_in.msgxtcl\msgs\en_nz.msgxtcl\msgs\en_ph.msgxtcl\msgs\en_sg.msgxtcl\msgs\en_za.msgxtcl\msgs\en_zw.msgxtcl\msgs\eo.msgxtcl\msgs\es.msgxtcl\msgs\es_ar.msgxtcl\msgs\es_bo.msgxtcl\msgs\es_cl.msgxtcl\msgs\es_co.msgxtcl\msgs\es_cr.msgxtcl\msgs\es_do.msgxtcl\msgs\es_ec.msgxtcl\msgs\es_gt.msgxtcl\msgs\es_hn.msgxtcl\msgs\es_mx.msgxtcl\msgs\es_ni.msgxtcl\msgs\es_pa.msgxtcl\msgs\es_pe.msgxtcl\msgs\es_pr.msgxtcl\msgs\es_py.msgxtcl\msgs\es_sv.msgxtcl\msgs\es_uy.msgxtcl\msgs\es_ve.msgxtcl\msgs\et.msgxtcl\msgs\eu.msgxtcl\msgs\eu_es.msgxtcl\msgs\fa.msgxtcl\msgs\fa_in.msgxtcl\msgs\fa_ir.msgxtcl\msgs\fi.msgxtcl\msgs\fo.msgxtcl\msgs\fo_fo.msgxtcl\msgs\fr.msgxtcl\msgs\fr_be.msgxtcl\msgs\fr_ca.msgxtcl\msgs\fr_ch.msgxtcl\msgs\ga.msgxtcl\msgs\ga_ie.msgxtcl\msgs\gl.msgxtcl\msgs\gl_es.msgxtcl\msgs\gv.msgxtcl\msgs\gv_gb.msgxtcl\msgs\he.msgxtcl\msgs\hi.msgxtcl\msgs\hi_in.msgxtcl\msgs\hr.msgxtcl\msgs\hu.msgxtcl\msgs\id.msgxtcl\msgs\id_id.msgxtcl\msgs\is.msgxtcl\msgs\it.msgxtcl\msgs\it_ch.msgxtcl\msgs\ja.msgxtcl\msgs\kl.msgxtcl\msgs\kl_gl.msgxtcl\msgs\ko.msgxtcl\msgs\ko_kr.msgxtcl\msgs\kok.msgxtcl\msgs\kok_in.msgxtcl\msgs\kw.msgxtcl\msgs\kw_gb.msgxtcl\msgs\lt.msgxtcl\msgs\lv.msgxtcl\msgs\mk.msgxtcl\msgs\mr.msgxtcl\msgs\mr_in.msgxtcl\msgs\ms.msgxtcl\msgs\ms_my.msgxtcl\msgs\mt.msgxtcl\msgs\nb.msgxtcl\msgs\nl.msgxtcl\msgs\nl_be.msgxtcl\msgs\nn.msgxtcl\msgs\pl.msgxtcl\msgs\pt.msgxtcl\msgs\pt_br.msgxtcl\msgs\ro.msgxtcl\msgs\ru.msgxtcl\msgs\ru_ua.msgxtcl\msgs\sh.msgxtcl\msgs\sk.msgxtcl\msgs\sl.msgxtcl\msgs\sq.msgxtcl\msgs\sr.msgxtcl\msgs\sv.msgxtcl\msgs\sw.msgxtcl\msgs\ta.msgxtcl\msgs\ta_in.msgxtcl\msgs\te.msgxtcl\msgs\te_in.msgxtcl\msgs\th.msgxtcl\msgs\tr.msgxtcl\msgs\uk.msgxtcl\msgs\vi.msgxtcl\msgs\zh.msgxtcl\msgs\zh_cn.msgxtcl\msgs\zh_hk.msgxtcl\msgs\zh_sg.msgxtcl\msgs\zh_tw.msgxtcl\opt0.4\optparse.tclxtcl\opt0.4\pkgindex.tclxtcl\package.tclxtcl\parray.tclxtcl\safe.tclxtcl\tclindexxtcl\tm.tclxtcl\tzdata\africa\abidjanxtcl\tzdata\africa\accraxtcl\tzdata\africa\addis_ababaxtcl\tzdata\africa\algiersxtcl\tzdata\africa\asmaraxtcl\tzdata\africa\asmeraxtcl\tzdata\africa\bamakoxtcl\tzdata\africa\banguixtcl\tzdata\africa\banjulxtcl\tzdata\africa\bissauxtcl\tzdata\africa\blantyrextcl\tzdata\africa\brazzavillextcl\tzdata\africa\bujumburaxtcl\tzdata\africa\cairoxtcl\tzdata\africa\casablancaxtcl\tzdata\africa\ceutaxtcl\tzdata\africa\conakryxtcl\tzdata\africa\dakarxtcl\tzdata\africa\dar_es_salaamxtcl\tzdata\africa\djiboutixtcl\tzdata\africa\doualaxtcl\tzdata\africa\el_aaiunxtcl\tzdata\africa\freetownxtcl\tzdata\africa\gaboronextcl\tzdata\africa\hararextcl\tzdata\africa\johannesburgxtcl\tzdata\africa\jubaxtcl\tzdata\africa\kampalaxtcl\tzdata\africa\khartoumxtcl\tzdata\africa\kigalixtcl\tzdata\africa\kinshasaxtcl\tzdata\africa\lagosxtcl\tzdata\africa\librevillextcl\tzdata\africa\lomextcl\tzdata\africa\luandaxtcl\tzdata\africa\lubumbashixtcl\tzdata\africa\lusakaxtcl\tzdata\africa\malaboxtcl\tzdata\africa\maputoxtcl\tzdata\africa\maseruxtcl\tzdata\africa\mbabanextcl\tzdata\africa\mogadishuxtcl\tzdata\africa\monroviaxtcl\tzdata\africa\nairobixtcl\tzdata\africa\ndjamenaxtcl\tzdata\africa\niameyxtcl\tzdata\africa\nouakchottxtcl\tzdata\africa\ouagadougouxtcl\tzdata\africa\porto-novoxtcl\tzdata\africa\sao_tomextcl\tzdata\africa\timbuktuxtcl\tzdata\africa\tripolixtcl\tzdata\africa\tunisxtcl\tzdata\africa\windhoekxtcl\tzdata\america\adakxtcl\tzdata\america\anchoragextcl\tzdata\america\anguillaxtcl\tzdata\america\antiguaxtcl\tzdata\america\araguainaxtcl\tzdata\america\argentina\buenos_airesxtcl\tzdata\america\argentina\catamarcaxtcl\tzdata\america\argentina\comodrivadaviaxtcl\tzdata\america\argentina\cordobaxtcl\tzdata\america\argentina\jujuyxtcl\tzdata\america\argentina\la_riojaxtcl\tzdata\america\argentina\mendozaxtcl\tzdata\america\argentina\rio_gallegosxtcl\tzdata\america\argentina\saltaxtcl\tzdata\america\argentina\san_juanxtcl\tzdata\america\argentina\san_luisxtcl\tzdata\america\argentina\tucumanxtcl\tzdata\america\argentina\ushuaiaxtcl\tzdata\america\arubaxtcl\tzdata\america\asuncionxtcl\tzdata\america\atikokanxtcl\tzdata\america\atkaxtcl\tzdata\america\bahiaxtcl\tzdata\america\bahia_banderasxtcl\tzdata\america\barbadosxtcl\tzdata\america\belemxtcl\tzdata\america\belizextcl\tzdata\america\blanc-sablonxtcl\tzdata\america\boa_vistaxtcl\tzdata\america\bogotaxtcl\tzdata\america\boisextcl\tzdata\america\buenos_airesxtcl\tzdata\america\cambridge_bayxtcl\tzdata\america\campo_grandextcl\tzdata\america\cancunxtcl\tzdata\america\caracasxtcl\tzdata\america\catamarcaxtcl\tzdata\america\cayennextcl\tzdata\america\caymanxtcl\tzdata\america\chicagoxtcl\tzdata\america\chihuahuaxtcl\tzdata\america\coral_harbourxtcl\tzdata\america\cordobaxtcl\tzdata\america\costa_ricaxtcl\tzdata\america\crestonxtcl\tzdata\america\cuiabaxtcl\tzdata\america\curacaoxtcl\tzdata\america\danmarkshavnxtcl\tzdata\america\dawsonxtcl\tzdata\america\dawson_creekxtcl\tzdata\america\denverxtcl\tzdata\america\detroitxtcl\tzdata\america\dominicaxtcl\tzdata\america\edmontonxtcl\tzdata\america\eirunepextcl\tzdata\america\el_salvadorxtcl\tzdata\america\ensenadaxtcl\tzdata\america\fort_nelsonxtcl\tzdata\america\fort_waynextcl\tzdata\america\fortalezaxtcl\tzdata\america\glace_bayxtcl\tzdata\america\godthabxtcl\tzdata\america\goose_bayxtcl\tzdata\america\grand_turkxtcl\tzdata\america\grenadaxtcl\tzdata\america\guadeloupextcl\tzdata\america\guatemalaxtcl\tzdata\america\guayaquilxtcl\tzdata\america\guyanaxtcl\tzdata\america\halifaxxtcl\tzdata\america\havanaxtcl\tzdata\america\hermosilloxtcl\tzdata\america\indiana\indianapolisxtcl\tzdata\america\indiana\knoxxtcl\tzdata\america\indiana\marengoxtcl\tzdata\america\indiana\petersburgxtcl\tzdata\america\indiana\tell_cityxtcl\tzdata\america\indiana\vevayxtcl\tzdata\america\indiana\vincennesxtcl\tzdata\america\indiana\winamacxtcl\tzdata\america\indianapolisxtcl\tzdata\america\inuvikxtcl\tzdata\america\iqaluitxtcl\tzdata\america\jamaicaxtcl\tzdata\america\jujuyxtcl\tzdata\america\juneauxtcl\tzdata\america\kentucky\louisvillextcl\tzdata\america\kentucky\monticelloxtcl\tzdata\america\knox_inxtcl\tzdata\america\kralendijkxtcl\tzdata\america\la_pazxtcl\tzdata\america\limaxtcl\tzdata\america\los_angelesxtcl\tzdata\america\louisvillextcl\tzdata\america\lower_princesxtcl\tzdata\america\maceioxtcl\tzdata\america\managuaxtcl\tzdata\america\manausxtcl\tzdata\america\marigotxtcl\tzdata\america\martiniquextcl\tzdata\america\matamorosxtcl\tzdata\america\mazatlanxtcl\tzdata\america\mendozaxtcl\tzdata\america\menomineextcl\tzdata\america\meridaxtcl\tzdata\america\metlakatlaxtcl\tzdata\america\mexico_cityxtcl\tzdata\america\miquelonxtcl\tzdata\america\monctonxtcl\tzdata\america\monterreyxtcl\tzdata\america\montevideoxtcl\tzdata\america\montrealxtcl\tzdata\america\montserratxtcl\tzdata\america\nassauxtcl\tzdata\america\new_yorkxtcl\tzdata\america\nipigonxtcl\tzdata\america\nomextcl\tzdata\america\noronhaxtcl\tzdata\america\north_dakota\beulahxtcl\tzdata\america\north_dakota\centerxtcl\tzdata\america\north_dakota\new_salemxtcl\tzdata\america\ojinagaxtcl\tzdata\america\panamaxtcl\tzdata\america\pangnirtungxtcl\tzdata\america\paramariboxtcl\tzdata\america\phoenixxtcl\tzdata\america\port-au-princextcl\tzdata\america\port_of_spainxtcl\tzdata\america\porto_acrextcl\tzdata\america\porto_velhoxtcl\tzdata\america\puerto_ricoxtcl\tzdata\america\punta_arenasxtcl\tzdata\america\rainy_riverxtcl\tzdata\america\rankin_inletxtcl\tzdata\america\recifextcl\tzdata\america\reginaxtcl\tzdata\america\resolutextcl\tzdata\america\rio_brancoxtcl\tzdata\america\rosarioxtcl\tzdata\america\santa_isabelxtcl\tzdata\america\santaremxtcl\tzdata\america\santiagoxtcl\tzdata\america\santo_domingoxtcl\tzdata\america\sao_pauloxtcl\tzdata\america\scoresbysundxtcl\tzdata\america\shiprockxtcl\tzdata\america\sitkaxtcl\tzdata\america\st_barthelemyxtcl\tzdata\america\st_johnsxtcl\tzdata\america\st_kittsxtcl\tzdata\america\st_luciaxtcl\tzdata\america\st_thomasxtcl\tzdata\america\st_vincentxtcl\tzdata\america\swift_currentxtcl\tzdata\america\tegucigalpaxtcl\tzdata\america\thulextcl\tzdata\america\thunder_bayxtcl\tzdata\america\tijuanaxtcl\tzdata\america\torontoxtcl\tzdata\america\tortolaxtcl\tzdata\america\vancouverxtcl\tzdata\america\virginxtcl\tzdata\america\whitehorsextcl\tzdata\america\winnipegxtcl\tzdata\america\yakutatxtcl\tzdata\america\yellowknifextcl\tzdata\antarctica\caseyxtcl\tzdata\antarctica\davisxtcl\tzdata\antarctica\dumontdurvillextcl\tzdata\antarctica\macquariextcl\tzdata\antarctica\mawsonxtcl\tzdata\antarctica\mcmurdoxtcl\tzdata\antarctica\palmerxtcl\tzdata\antarctica\rotheraxtcl\tzdata\antarctica\south_polextcl\tzdata\antarctica\syowaxtcl\tzdata\antarctica\trollxtcl\tzdata\antarctica\vostokxtcl\tzdata\arctic\longyearbyenxtcl\tzdata\asia\adenxtcl\tzdata\asia\almatyxtcl\tzdata\asia\ammanxtcl\tzdata\asia\anadyrxtcl\tzdata\asia\aqtauxtcl\tzdata\asia\aqtobextcl\tzdata\asia\ashgabatxtcl\tzdata\asia\ashkhabadxtcl\tzdata\asia\atyrauxtcl\tzdata\asia\baghdadxtcl\tzdata\asia\bahrainxtcl\tzdata\asia\bakuxtcl\tzdata\asia\bangkokxtcl\tzdata\asia\barnaulxtcl\tzdata\asia\beirutxtcl\tzdata\asia\bishkekxtcl\tzdata\asia\bruneixtcl\tzdata\asia\calcuttaxtcl\tzdata\asia\chitaxtcl\tzdata\asia\choibalsanxtcl\tzdata\asia\chongqingxtcl\tzdata\asia\chungkingxtcl\tzdata\asia\colomboxtcl\tzdata\asia\daccaxtcl\tzdata\asia\damascusxtcl\tzdata\asia\dhakaxtcl\tzdata\asia\dilixtcl\tzdata\asia\dubaixtcl\tzdata\asia\dushanbextcl\tzdata\asia\famagustaxtcl\tzdata\asia\gazaxtcl\tzdata\asia\harbinxtcl\tzdata\asia\hebronxtcl\tzdata\asia\ho_chi_minhxtcl\tzdata\asia\hong_kongxtcl\tzdata\asia\hovdxtcl\tzdata\asia\irkutskxtcl\tzdata\asia\istanbulxtcl\tzdata\asia\jakartaxtcl\tzdata\asia\jayapuraxtcl\tzdata\asia\jerusalemxtcl\tzdata\asia\kabulxtcl\tzdata\asia\kamchatkaxtcl\tzdata\asia\karachixtcl\tzdata\asia\kashgarxtcl\tzdata\asia\kathmanduxtcl\tzdata\asia\katmanduxtcl\tzdata\asia\khandygaxtcl\tzdata\asia\kolkataxtcl\tzdata\asia\krasnoyarskxtcl\tzdata\asia\kuala_lumpurxtcl\tzdata\asia\kuchingxtcl\tzdata\asia\kuwaitxtcl\tzdata\asia\macaoxtcl\tzdata\asia\macauxtcl\tzdata\asia\magadanxtcl\tzdata\asia\makassarxtcl\tzdata\asia\manilaxtcl\tzdata\asia\muscatxtcl\tzdata\asia\nicosiaxtcl\tzdata\asia\novokuznetskxtcl\tzdata\asia\novosibirskxtcl\tzdata\asia\omskxtcl\tzdata\asia\oralxtcl\tzdata\asia\phnom_penhxtcl\tzdata\asia\pontianakxtcl\tzdata\asia\pyongyangxtcl\tzdata\asia\qatarxtcl\tzdata\asia\qyzylordaxtcl\tzdata\asia\rangoonxtcl\tzdata\asia\riyadhxtcl\tzdata\asia\saigonxtcl\tzdata\asia\sakhalinxtcl\tzdata\asia\samarkandxtcl\tzdata\asia\seoulxtcl\tzdata\asia\shanghaixtcl\tzdata\asia\singaporextcl\tzdata\asia\srednekolymskxtcl\tzdata\asia\taipeixtcl\tzdata\asia\tashkentxtcl\tzdata\asia\tbilisixtcl\tzdata\asia\tehranxtcl\tzdata\asia\tel_avivxtcl\tzdata\asia\thimbuxtcl\tzdata\asia\thimphuxtcl\tzdata\asia\tokyoxtcl\tzdata\asia\tomskxtcl\tzdata\asia\ujung_pandangxtcl\tzdata\asia\ulaanbaatarxtcl\tzdata\asia\ulan_batorxtcl\tzdata\asia\urumqixtcl\tzdata\asia\ust-neraxtcl\tzdata\asia\vientianextcl\tzdata\asia\vladivostokxtcl\tzdata\asia\yakutskxtcl\tzdata\asia\yangonxtcl\tzdata\asia\yekaterinburgxtcl\tzdata\asia\yerevanxtcl\tzdata\atlantic\azoresxtcl\tzdata\atlantic\bermudaxtcl\tzdata\atlantic\canaryxtcl\tzdata\atlantic\cape_verdextcl\tzdata\atlantic\faeroextcl\tzdata\atlantic\faroextcl\tzdata\atlantic\jan_mayenxtcl\tzdata\atlantic\madeiraxtcl\tzdata\atlantic\reykjavikxtcl\tzdata\atlantic\south_georgiaxtcl\tzdata\atlantic\st_helenaxtcl\tzdata\atlantic\stanleyxtcl\tzdata\australia\actxtcl\tzdata\australia\adelaidextcl\tzdata\australia\brisbanextcl\tzdata\australia\broken_hillxtcl\tzdata\australia\canberraxtcl\tzdata\australia\curriextcl\tzdata\australia\darwinxtcl\tzdata\australia\euclaxtcl\tzdata\australia\hobartxtcl\tzdata\australia\lhixtcl\tzdata\australia\lindemanxtcl\tzdata\australia\lord_howextcl\tzdata\australia\melbournextcl\tzdata\australia\nswxtcl\tzdata\australia\northxtcl\tzdata\australia\perthxtcl\tzdata\australia\queenslandxtcl\tzdata\australia\southxtcl\tzdata\australia\sydneyxtcl\tzdata\australia\tasmaniaxtcl\tzdata\australia\victoriaxtcl\tzdata\australia\westxtcl\tzdata\australia\yancowinnaxtcl\tzdata\brazil\acrextcl\tzdata\brazil\denoronhaxtcl\tzdata\brazil\eastxtcl\tzdata\brazil\westxtcl\tzdata\cetxtcl\tzdata\cst6cdtxtcl\tzdata\canada\atlanticxtcl\tzdata\canada\centralxtcl\tzdata\canada\east-saskatchewanxtcl\tzdata\canada\easternxtcl\tzdata\canada\mountainxtcl\tzdata\canada\newfoundlandxtcl\tzdata\canada\pacificxtcl\tzdata\canada\saskatchewanxtcl\tzdata\canada\yukonxtcl\tzdata\chile\continentalxtcl\tzdata\chile\easterislandxtcl\tzdata\cubaxtcl\tzdata\eetxtcl\tzdata\estxtcl\tzdata\est5edtxtcl\tzdata\egyptxtcl\tzdata\eirextcl\tzdata\etc\gmtxtcl\tzdata\etc\gmt+0xtcl\tzdata\etc\gmt+1xtcl\tzdata\etc\gmt+10xtcl\tzdata\etc\gmt+11xtcl\tzdata\etc\gmt+12xtcl\tzdata\etc\gmt+2xtcl\tzdata\etc\gmt+3xtcl\tzdata\etc\gmt+4xtcl\tzdata\etc\gmt+5xtcl\tzdata\etc\gmt+6xtcl\tzdata\etc\gmt+7xtcl\tzdata\etc\gmt+8xtcl\tzdata\etc\gmt+9xtcl\tzdata\etc\gmt-0xtcl\tzdata\etc\gmt-1xtcl\tzdata\etc\gmt-10xtcl\tzdata\etc\gmt-11xtcl\tzdata\etc\gmt-12xtcl\tzdata\etc\gmt-13xtcl\tzdata\etc\gmt-14xtcl\tzdata\etc\gmt-2xtcl\tzdata\etc\gmt-3xtcl\tzdata\etc\gmt-4xtcl\tzdata\etc\gmt-5xtcl\tzdata\etc\gmt-6xtcl\tzdata\etc\gmt-7xtcl\tzdata\etc\gmt-8xtcl\tzdata\etc\gmt-9xtcl\tzdata\etc\gmt0xtcl\tzdata\etc\greenwichxtcl\tzdata\etc\uctxtcl\tzdata\etc\utcxtcl\tzdata\etc\universalxtcl\tzdata\etc\zuluxtcl\tzdata\europe\amsterdamxtcl\tzdata\europe\andorraxtcl\tzdata\europe\astrakhanxtcl\tzdata\europe\athensxtcl\tzdata\europe\belfastxtcl\tzdata\europe\belgradextcl\tzdata\europe\berlinxtcl\tzdata\europe\bratislavaxtcl\tzdata\europe\brusselsxtcl\tzdata\europe\bucharestxtcl\tzdata\europe\budapestxtcl\tzdata\europe\busingenxtcl\tzdata\europe\chisinauxtcl\tzdata\europe\copenhagenxtcl\tzdata\europe\dublinxtcl\tzdata\europe\gibraltarxtcl\tzdata\europe\guernseyxtcl\tzdata\europe\helsinkixtcl\tzdata\europe\isle_of_manxtcl\tzdata\europe\istanbulxtcl\tzdata\europe\jerseyxtcl\tzdata\europe\kaliningradxtcl\tzdata\europe\kievxtcl\tzdata\europe\kirovxtcl\tzdata\europe\lisbonxtcl\tzdata\europe\ljubljanaxtcl\tzdata\europe\londonxtcl\tzdata\europe\luxembourgxtcl\tzdata\europe\madridxtcl\tzdata\europe\maltaxtcl\tzdata\europe\mariehamnxtcl\tzdata\europe\minskxtcl\tzdata\europe\monacoxtcl\tzdata\europe\moscowxtcl\tzdata\europe\nicosiaxtcl\tzdata\europe\osloxtcl\tzdata\europe\parisxtcl\tzdata\europe\podgoricaxtcl\tzdata\europe\praguextcl\tzdata\europe\rigaxtcl\tzdata\europe\romextcl\tzdata\europe\samaraxtcl\tzdata\europe\san_marinoxtcl\tzdata\europe\sarajevoxtcl\tzdata\europe\saratovxtcl\tzdata\europe\simferopolxtcl\tzdata\europe\skopjextcl\tzdata\europe\sofiaxtcl\tzdata\europe\stockholmxtcl\tzdata\europe\tallinnxtcl\tzdata\europe\tiranextcl\tzdata\europe\tiraspolxtcl\tzdata\europe\ulyanovskxtcl\tzdata\europe\uzhgorodxtcl\tzdata\europe\vaduzxtcl\tzdata\europe\vaticanxtcl\tzdata\europe\viennaxtcl\tzdata\europe\vilniusxtcl\tzdata\europe\volgogradxtcl\tzdata\europe\warsawxtcl\tzdata\europe\zagrebxtcl\tzdata\europe\zaporozhyextcl\tzdata\europe\zurichxtcl\tzdata\gbxtcl\tzdata\gb-eirextcl\tzdata\gmtxtcl\tzdata\gmt+0xtcl\tzdata\gmt-0xtcl\tzdata\gmt0xtcl\tzdata\greenwichxtcl\tzdata\hstxtcl\tzdata\hongkongxtcl\tzdata\icelandxtcl\tzdata\indian\antananarivoxtcl\tzdata\indian\chagosxtcl\tzdata\indian\christmasxtcl\tzdata\indian\cocosxtcl\tzdata\indian\comoroxtcl\tzdata\indian\kerguelenxtcl\tzdata\indian\mahextcl\tzdata\indian\maldivesxtcl\tzdata\indian\mauritiusxtcl\tzdata\indian\mayottextcl\tzdata\indian\reunionxtcl\tzdata\iranxtcl\tzdata\israelxtcl\tzdata\jamaicaxtcl\tzdata\japanxtcl\tzdata\kwajaleinxtcl\tzdata\libyaxtcl\tzdata\metxtcl\tzdata\mstxtcl\tzdata\mst7mdtxtcl\tzdata\mexico\bajanortextcl\tzdata\mexico\bajasurxtcl\tzdata\mexico\generalxtcl\tzdata\nzxtcl\tzdata\nz-chatxtcl\tzdata\navajoxtcl\tzdata\prcxtcl\tzdata\pst8pdtxtcl\tzdata\pacific\apiaxtcl\tzdata\pacific\aucklandxtcl\tzdata\pacific\bougainvillextcl\tzdata\pacific\chathamxtcl\tzdata\pacific\chuukxtcl\tzdata\pacific\easterxtcl\tzdata\pacific\efatextcl\tzdata\pacific\enderburyxtcl\tzdata\pacific\fakaofoxtcl\tzdata\pacific\fijixtcl\tzdata\pacific\funafutixtcl\tzdata\pacific\galapagosxtcl\tzdata\pacific\gambierxtcl\tzdata\pacific\guadalcanalxtcl\tzdata\pacific\guamxtcl\tzdata\pacific\honoluluxtcl\tzdata\pacific\johnstonxtcl\tzdata\pacific\kiritimatixtcl\tzdata\pacific\kosraextcl\tzdata\pacific\kwajaleinxtcl\tzdata\pacific\majuroxtcl\tzdata\pacific\marquesasxtcl\tzdata\pacific\midwayxtcl\tzdata\pacific\nauruxtcl\tzdata\pacific\niuextcl\tzdata\pacific\norfolkxtcl\tzdata\pacific\noumeaxtcl\tzdata\pacific\pago_pagoxtcl\tzdata\pacific\palauxtcl\tzdata\pacific\pitcairnxtcl\tzdata\pacific\pohnpeixtcl\tzdata\pacific\ponapextcl\tzdata\pacific\port_moresbyxtcl\tzdata\pacific\rarotongaxtcl\tzdata\pacific\saipanxtcl\tzdata\pacific\samoaxtcl\tzdata\pacific\tahitixtcl\tzdata\pacific\tarawaxtcl\tzdata\pacific\tongatapuxtcl\tzdata\pacific\trukxtcl\tzdata\pacific\wakextcl\tzdata\pacific\wallisxtcl\tzdata\pacific\yapxtcl\tzdata\polandxtcl\tzdata\portugalxtcl\tzdata\rocxtcl\tzdata\rokxtcl\tzdata\singaporextcl\tzdata\systemv\ast4xtcl\tzdata\systemv\ast4adtxtcl\tzdata\systemv\cst6xtcl\tzdata\systemv\cst6cdtxtcl\tzdata\systemv\est5xtcl\tzdata\systemv\est5edtxtcl\tzdata\systemv\hst10xtcl\tzdata\systemv\mst7xtcl\tzdata\systemv\mst7mdtxtcl\tzdata\systemv\pst8xtcl\tzdata\systemv\pst8pdtxtcl\tzdata\systemv\yst9xtcl\tzdata\systemv\yst9ydtxtcl\tzdata\turkeyxtcl\tzdata\uctxtcl\tzdata\us\alaskaxtcl\tzdata\us\aleutianxtcl\tzdata\us\arizonaxtcl\tzdata\us\centralxtcl\tzdata\us\east-indianaxtcl\tzdata\us\easternxtcl\tzdata\us\hawaiixtcl\tzdata\us\indiana-starkextcl\tzdata\us\michiganxtcl\tzdata\us\mountainxtcl\tzdata\us\pacificxtcl\tzdata\us\pacific-newxtcl\tzdata\us\samoaxtcl\tzdata\utcxtcl\tzdata\universalxtcl\tzdata\w-suxtcl\tzdata\wetxtcl\tzdata\zuluxtcl\word.tclxtk\bgerror.tclxtk\button.tclxtk\choosedir.tclxtk\clrpick.tclxtk\comdlg.tclxtk\console.tclxtk\dialog.tclxtk\entry.tclxtk\focus.tclxtk\fontchooser.tclxtk\iconlist.tclxtk\icons.tclxtk\images\readmextk\images\logo.epsxtk\images\logo100.gifxtk\images\logo64.gifxtk\images\logolarge.gifxtk\images\logomed.gifxtk\images\pwrdlogo.epsxtk\images\pwrdlogo100.gifxtk\images\pwrdlogo150.gifxtk\images\pwrdlogo175.gifxtk\images\pwrdlogo200.gifxtk\images\pwrdlogo75.gifxtk\images\tai-ku.gifxtk\license.termsxtk\listbox.tclxtk\megawidget.tclxtk\menu.tclxtk\mkpsenc.tclxtk\msgbox.tclxtk\msgs\cs.msgxtk\msgs\da.msgxtk\msgs\de.msgxtk\msgs\el.msgxtk\msgs\en.msgxtk\msgs\en_gb.msgxtk\msgs\eo.msgxtk\msgs\es.msgxtk\msgs\fr.msgxtk\msgs\hu.msgxtk\msgs\it.msgxtk\msgs\nl.msgxtk\msgs\pl.msgxtk\msgs\pt.msgxtk\msgs\ru.msgxtk\msgs\sv.msgxtk\obsolete.tclxtk\optmenu.tclxtk\palette.tclxtk\panedwindow.tclxtk\pkgindex.tclxtk\safetk.tclxtk\scale.tclxtk\scrlbar.tclxtk\spinbox.tclxtk\tclindexxtk\tearoff.tclxtk\text.tclxtk\tk.tclxtk\tkfbox.tclxtk\ttk\alttheme.tclxtk\ttk\aquatheme.tclxtk\ttk\button.tclxtk\ttk\clamtheme.tclxtk\ttk\classictheme.tclxtk\ttk\combobox.tclxtk\ttk\cursors.tclxtk\ttk\defaults.tclxtk\ttk\entry.tclxtk\ttk\fonts.tclxtk\ttk\menubutton.tclxtk\ttk\notebook.tclxtk\ttk\panedwindow.tclxtk\ttk\progress.tclxtk\ttk\scale.tclxtk\ttk\scrollbar.tclxtk\ttk\sizegrip.tclxtk\ttk\spinbox.tclxtk\ttk\treeview.tclxtk\ttk\ttk.tclxtk\ttk\utils.tclxtk\ttk\vistatheme.tclxtk\ttk\wintheme.tclxtk\ttk\xptheme.tclxtk\unsupported.tclxtk\xmfbox.tclzpyz-00.pyz@/=i'c<3lmempe>$p&o<3" - Source: "00000000-00005988.00000001.119462.9CC50000.00000004.mdmp") Found URL "http://crlkxxgmt=+lumstructmpyimod01_archivempyimod02_importersmpyimod03_ctypesmpyimod04_pywin32spyiboot01_bootstrapspyi_rth_inspectspyi_rth__tkintersactivationbvcruntime140.dllb_bz2.pydb_ctypes.pydb_hashlib.pydb_lzma.pydb_queue.pydb_socket.pydb_ssl.pydb_tkinter.pydbapi-ms-win-core-console-l1-1-0.dllbapi-ms-win-core-datetime-l1-1-0.dllbapi-ms-win-core-debug-l1-1-0.dllbapi-ms-win-core-errorhandling-l1-1-0.dllbapi-ms-win-core-fibers-l1-1-0.dllbapi-ms-win-core-fibers-l1-1-1.dllbapi-ms-win-core-file-l1-1-0.dllbapi-ms-win-core-file-l1-2-0.dllbapi-ms-win-core-file-l2-1-0.dllbapi-ms-win-core-handle-l1-1-0.dllbapi-ms-win-core-heap-l1-1-0.dllbapi-ms-win-core-interlocked-l1-1-0.dllbapi-ms-win-core-kernel32-legacy-l1-1-1.dllbapi-ms-win-core-libraryloader-l1-1-0.dllbapi-ms-win-core-localization-l1-2-0.dllbapi-ms-win-core-memory-l1-1-0.dllbapi-ms-win-core-namedpipe-l1-1-0.dllbapi-ms-win-core-processenvironment-l1-1-0.dllbapi-ms-win-core-processthreads-l1-1-0.dllbapi-ms-win-core-processthreads-l1-1-1.dllbapi-ms-win-core-profile-l1-1-0.dllbapi-ms-win-core-rtlsupport-l1-1-0.dllbapi-ms-win-core-string-l1-1-0.dllbapi-ms-win-core-synch-l1-1-0.dllbapi-ms-win-core-synch-l1-2-0.dllbapi-ms-win-core-sysinfo-l1-1-0.dllbapi-ms-win-core-sysinfo-l1-2-0.dllbapi-ms-win-core-timezone-l1-1-0.dllbapi-ms-win-core-util-l1-1-0.dllbapi-ms-win-crt-conio-l1-1-0.dllbapi-ms-win-crt-convert-l1-1-0.dllbapi-ms-win-crt-environment-l1-1-0.dllbapi-ms-win-crt-filesystem-l1-1-0.dllbapi-ms-win-crt-heap-l1-1-0.dllbapi-ms-win-crt-locale-l1-1-0.dllbapi-ms-win-crt-math-l1-1-0.dllbapi-ms-win-crt-process-l1-1-0.dllbapi-ms-win-crt-runtime-l1-1-0.dllbapi-ms-win-crt-stdio-l1-1-0.dllbapi-ms-win-crt-string-l1-1-0.dllbapi-ms-win-crt-time-l1-1-0.dllbapi-ms-win-crt-utility-l1-1-0.dllbcharset_normalizer\cd.pydbcharset_normalizer\md.pydblibcrypto-1_1.dllblibssl-1_1.dllbpyarmor_runtime_000000\pyarmor_runtime.pydbpython3.dllbpython37.dllbselect.pydbtcl86t.dllbtk86t.dllbucrtbase.dllbunicodedata.pydxbase_library.zipxcertifi\cacert.pemxcertifi\py.typedxcustomtkinter\assets\.ds_storexcustomtkinter\assets\fonts\customtkinter_shapes_font.otfxcustomtkinter\assets\fonts\roboto\roboto-medium.ttfxcustomtkinter\assets\fonts\roboto\roboto-regular.ttfxcustomtkinter\assets\icons\.ds_storexcustomtkinter\assets\icons\customtkinter_icon_windows.icoxcustomtkinter\assets\themes\blue.jsonxcustomtkinter\assets\themes\dark-blue.jsonxcustomtkinter\assets\themes\green.jsonxicon.icoxsetup.exexsppcplus32.dllxsppcplus64.dllxtcl8\8.4\platform-1.0.14.tmxtcl8\8.4\platform\shell-1.1.4.tmxtcl8\8.5\msgcat-1.6.1.tmxtcl8\8.5\tcltest-2.5.0.tmxtcl8\8.6\http-2.9.0.tmxtcl\auto.tclxtcl\clock.tclxtcl\encoding\ascii.encxtcl\encoding\big5.encxtcl\encoding\cp1250.encxtcl\encoding\cp1251.encxtcl\encoding\cp1252.encxtcl\encoding\cp1253.encxtcl\encoding\cp1254.encxtcl\encoding\cp1255.encxtcl\encoding\cp1256.encxtcl\encoding\cp1257.encxtcl\encoding\cp1258.encxtcl\encoding\cp437.encxtcl\encoding\cp737.encxtcl\encoding\cp775.encxtcl\encoding\cp850.encxtcl\encoding\cp852.encxtcl\encoding\cp855.encxtcl\encoding\cp857.encxtcl\encoding\cp860.encxtcl\encoding\cp861.encxtcl\encoding\cp862.encxtcl\encoding\cp863.encxtcl\encoding\cp864.encxtcl\encoding\cp865.encxtcl\encoding\cp866.encxtcl\encoding\cp869.encxtcl\encoding\cp874.encxtcl\encoding\cp932.encxtcl\encoding\cp936.encxtcl\encoding\cp949.encxtcl\encoding\cp950.encxtcl\encoding\dingbats.encxtcl\encoding\ebcdic.encxtcl\encoding\euc-cn.encxtcl\encoding\euc-jp.encxtcl\encoding\euc-kr.encxtcl\encoding\gb12345.encxtcl\encoding\gb1988.encxtcl\encoding\gb2312-raw.encxtcl\encoding\gb2312.encxtcl\encoding\iso2022-jp.encxtcl\encoding\iso2022-kr.encxtcl\encoding\iso2022.encxtcl\encoding\iso8859-1.encxtcl\encoding\iso8859-10.encxtcl\encoding\iso8859-13.encxtcl\encoding\iso8859-14.encxtcl\encoding\iso8859-15.encxtcl\encoding\iso8859-16.encxtcl\encoding\iso8859-2.encxtcl\encoding\iso8859-3.encxtcl\encoding\iso8859-4.encxtcl\encoding\iso8859-5.encxtcl\encoding\iso8859-6.encxtcl\encoding\iso8859-7.encxtcl\encoding\iso8859-8.encxtcl\encoding\iso8859-9.encxtcl\encoding\jis0201.encxtcl\encoding\jis0208.encxtcl\encoding\jis0212.encxtcl\encoding\koi8-r.encxtcl\encoding\koi8-u.encxtcl\encoding\ksc5601.encxtcl\encoding\maccenteuro.encxtcl\encoding\maccroatian.encxtcl\encoding\maccyrillic.encxtcl\encoding\macdingbats.encxtcl\encoding\macgreek.encxtcl\encoding\maciceland.encxtcl\encoding\macjapan.encxtcl\encoding\macroman.encxtcl\encoding\macromania.encxtcl\encoding\macthai.encxtcl\encoding\macturkish.encxtcl\encoding\macukraine.encxtcl\encoding\shiftjis.encxtcl\encoding\symbol.encxtcl\encoding\tis-620.encxtcl\history.tclxtcl\http1.0\http.tclxtcl\http1.0\pkgindex.tclxtcl\init.tclxtcl\msgs\af.msgxtcl\msgs\af_za.msgxtcl\msgs\ar.msgxtcl\msgs\ar_in.msgxtcl\msgs\ar_jo.msgxtcl\msgs\ar_lb.msgxtcl\msgs\ar_sy.msgxtcl\msgs\be.msgxtcl\msgs\bg.msgxtcl\msgs\bn.msgxtcl\msgs\bn_in.msgxtcl\msgs\ca.msgxtcl\msgs\cs.msgxtcl\msgs\da.msgxtcl\msgs\de.msgxtcl\msgs\de_at.msgxtcl\msgs\de_be.msgxtcl\msgs\el.msgxtcl\msgs\en_au.msgxtcl\msgs\en_be.msgxtcl\msgs\en_bw.msgxtcl\msgs\en_ca.msgxtcl\msgs\en_gb.msgxtcl\msgs\en_hk.msgxtcl\msgs\en_ie.msgxtcl\msgs\en_in.msgxtcl\msgs\en_nz.msgxtcl\msgs\en_ph.msgxtcl\msgs\en_sg.msgxtcl\msgs\en_za.msgxtcl\msgs\en_zw.msgxtcl\msgs\eo.msgxtcl\msgs\es.msgxtcl\msgs\es_ar.msgxtcl\msgs\es_bo.msgxtcl\msgs\es_cl.msgxtcl\msgs\es_co.msgxtcl\msgs\es_cr.msgxtcl\msgs\es_do.msgxtcl\msgs\es_ec.msgxtcl\msgs\es_gt.msgxtcl\msgs\es_hn.msgxtcl\msgs\es_mx.msgxtcl\msgs\es_ni.msgxtcl\msgs\es_pa.msgxtcl\msgs\es_pe.msgxtcl\msgs\es_pr.msgxtcl\msgs\es_py.msgxtcl\msgs\es_sv.msgxtcl\msgs\es_uy.msgxtcl\msgs\es_ve.msgxtcl\msgs\et.msgxtcl\msgs\eu.msgxtcl\msgs\eu_es.msgxtcl\msgs\fa.msgxtcl\msgs\fa_in.msgxtcl\msgs\fa_ir.msgxtcl\msgs\fi.msgxtcl\msgs\fo.msgxtcl\msgs\fo_fo.msgxtcl\msgs\fr.msgxtcl\msgs\fr_be.msgxtcl\msgs\fr_ca.msgxtcl\msgs\fr_ch.msgxtcl\msgs\ga.msgxtcl\msgs\ga_ie.msgxtcl\msgs\gl.msgxtcl\msgs\gl_es.msgxtcl\msgs\gv.msgxtcl\msgs\gv_gb.msgxtcl\msgs\he.msgxtcl\msgs\hi.msgxtcl\msgs\hi_in.msgxtcl\msgs\hr.msgxtcl\msgs\hu.msgxtcl\msgs\id.msgxtcl\msgs\id_id.msgxtcl\msgs\is.msgxtcl\msgs\it.msgxtcl\msgs\it_ch.msgxtcl\msgs\ja.msgxtcl\msgs\kl.msgxtcl\msgs\kl_gl.msgxtcl\msgs\ko.msgxtcl\msgs\ko_kr.msgxtcl\msgs\kok.msgxtcl\msgs\kok_in.msgxtcl\msgs\kw.msgxtcl\msgs\kw_gb.msgxtcl\msgs\lt.msgxtcl\msgs\lv.msgxtcl\msgs\mk.msgxtcl\msgs\mr.msgxtcl\msgs\mr_in.msgxtcl\msgs\ms.msgxtcl\msgs\ms_my.msgxtcl\msgs\mt.msgxtcl\msgs\nb.msgxtcl\msgs\nl.msgxtcl\msgs\nl_be.msgxtcl\msgs\nn.msgxtcl\msgs\pl.msgxtcl\msgs\pt.msgxtcl\msgs\pt_br.msgxtcl\msgs\ro.msgxtcl\msgs\ru.msgxtcl\msgs\ru_ua.msgxtcl\msgs\sh.msgxtcl\msgs\sk.msgxtcl\msgs\sl.msgxtcl\msgs\sq.msgxtcl\msgs\sr.msgxtcl\msgs\sv.msgxtcl\msgs\sw.msgxtcl\msgs\ta.msgxtcl\msgs\ta_in.msgxtcl\msgs\te.msgxtcl\msgs\te_in.msgxtcl\msgs\th.msgxtcl\msgs\tr.msgxtcl\msgs\uk.msgxtcl\msgs\vi.msgxtcl\msgs\zh.msgxtcl\msgs\zh_cn.msgxtcl\msgs\zh_hk.msgxtcl\msgs\zh_sg.msgxtcl\msgs\zh_tw.msgxtcl\opt0.4\optparse.tclxtcl\opt0.4\pkgindex.tclxtcl\package.tclxtcl\parray.tclxtcl\safe.tclxtcl\tclindexxtcl\tm.tclxtcl\tzdata\africa\abidjanxtcl\tzdata\africa\accraxtcl\tzdata\africa\addis_ababaxtcl\tzdata\africa\algiersxtcl\tzdata\africa\asmaraxtcl\tzdata\africa\asmeraxtcl\tzdata\africa\bamakoxtcl\tzdata\africa\banguixtcl\tzdata\africa\banjulxtcl\tzdata\africa\bissauxtcl\tzdata\africa\blantyrextcl\tzdata\africa\brazzavillextcl\tzdata\africa\bujumburaxtcl\tzdata\africa\cairoxtcl\tzdata\africa\casablancaxtcl\tzdata\africa\ceutaxtcl\tzdata\africa\conakryxtcl\tzdata\africa\dakarxtcl\tzdata\africa\dar_es_salaamxtcl\tzdata\africa\djiboutixtcl\tzdata\africa\doualaxtcl\tzdata\africa\el_aaiunxtcl\tzdata\africa\freetownxtcl\tzdata\africa\gaboronextcl\tzdata\africa\hararextcl\tzdata\africa\johannesburgxtcl\tzdata\africa\jubaxtcl\tzdata\africa\kampalaxtcl\tzdata\africa\khartoumxtcl\tzdata\africa\kigalixtcl\tzdata\africa\kinshasaxtcl\tzdata\africa\lagosxtcl\tzdata\africa\librevillextcl\tzdata\africa\lomextcl\tzdata\africa\luandaxtcl\tzdata\africa\lubumbashixtcl\tzdata\africa\lusakaxtcl\tzdata\africa\malaboxtcl\tzdata\africa\maputoxtcl\tzdata\africa\maseruxtcl\tzdata\africa\mbabanextcl\tzdata\africa\mogadishuxtcl\tzdata\africa\monroviaxtcl\tzdata\africa\nairobixtcl\tzdata\africa\ndjamenaxtcl\tzdata\africa\niameyxtcl\tzdata\africa\nouakchottxtcl\tzdata\africa\ouagadougouxtcl\tzdata\africa\porto-novoxtcl\tzdata\africa\sao_tomextcl\tzdata\africa\timbuktuxtcl\tzdata\africa\tripolixtcl\tzdata\africa\tunisxtcl\tzdata\africa\windhoekxtcl\tzdata\america\adakxtcl\tzdata\america\anchoragextcl\tzdata\america\anguillaxtcl\tzdata\america\antiguaxtcl\tzdata\america\araguainaxtcl\tzdata\america\argentina\buenos_airesxtcl\tzdata\america\argentina\catamarcaxtcl\tzdata\america\argentina\comodrivadaviaxtcl\tzdata\america\argentina\cordobaxtcl\tzdata\america\argentina\jujuyxtcl\tzdata\america\argentina\la_riojaxtcl\tzdata\america\argentina\mendozaxtcl\tzdata\america\argentina\rio_gallegosxtcl\tzdata\america\argentina\saltaxtcl\tzdata\america\argentina\san_juanxtcl\tzdata\america\argentina\san_luisxtcl\tzdata\america\argentina\tucumanxtcl\tzdata\america\argentina\ushuaiaxtcl\tzdata\america\arubaxtcl\tzdata\america\asuncionxtcl\tzdata\america\atikokanxtcl\tzdata\america\atkaxtcl\tzdata\america\bahiaxtcl\tzdata\america\bahia_banderasxtcl\tzdata\america\barbadosxtcl\tzdata\america\belemxtcl\tzdata\america\belizextcl\tzdata\america\blanc-sablonxtcl\tzdata\america\boa_vistaxtcl\tzdata\america\bogotaxtcl\tzdata\america\boisextcl\tzdata\america\buenos_airesxtcl\tzdata\america\cambridge_bayxtcl\tzdata\america\campo_grandextcl\tzdata\america\cancunxtcl\tzdata\america\caracasxtcl\tzdata\america\catamarcaxtcl\tzdata\america\cayennextcl\tzdata\america\caymanxtcl\tzdata\america\chicagoxtcl\tzdata\america\chihuahuaxtcl\tzdata\america\coral_harbourxtcl\tzdata\america\cordobaxtcl\tzdata\america\costa_ricaxtcl\tzdata\america\crestonxtcl\tzdata\america\cuiabaxtcl\tzdata\america\curacaoxtcl\tzdata\america\danmarkshavnxtcl\tzdata\america\dawsonxtcl\tzdata\america\dawson_creekxtcl\tzdata\america\denverxtcl\tzdata\america\detroitxtcl\tzdata\america\dominicaxtcl\tzdata\america\edmontonxtcl\tzdata\america\eirunepextcl\tzdata\america\el_salvadorxtcl\tzdata\america\ensenadaxtcl\tzdata\america\fort_nelsonxtcl\tzdata\america\fort_waynextcl\tzdata\america\fortalezaxtcl\tzdata\america\glace_bayxtcl\tzdata\america\godthabxtcl\tzdata\america\goose_bayxtcl\tzdata\america\grand_turkxtcl\tzdata\america\grenadaxtcl\tzdata\america\guadeloupextcl\tzdata\america\guatemalaxtcl\tzdata\america\guayaquilxtcl\tzdata\america\guyanaxtcl\tzdata\america\halifaxxtcl\tzdata\america\havanaxtcl\tzdata\america\hermosilloxtcl\tzdata\america\indiana\indianapolisxtcl\tzdata\america\indiana\knoxxtcl\tzdata\america\indiana\marengoxtcl\tzdata\america\indiana\petersburgxtcl\tzdata\america\indiana\tell_cityxtcl\tzdata\america\indiana\vevayxtcl\tzdata\america\indiana\vincennesxtcl\tzdata\america\indiana\winamacxtcl\tzdata\america\indianapolisxtcl\tzdata\america\inuvikxtcl\tzdata\america\iqaluitxtcl\tzdata\america\jamaicaxtcl\tzdata\america\jujuyxtcl\tzdata\america\juneauxtcl\tzdata\america\kentucky\louisvillextcl\tzdata\america\kentucky\monticelloxtcl\tzdata\america\knox_inxtcl\tzdata\america\kralendijkxtcl\tzdata\america\la_pazxtcl\tzdata\america\limaxtcl\tzdata\america\los_angelesxtcl\tzdata\america\louisvillextcl\tzdata\america\lower_princesxtcl\tzdata\america\maceioxtcl\tzdata\america\managuaxtcl\tzdata\america\manausxtcl\tzdata\america\marigotxtcl\tzdata\america\martiniquextcl\tzdata\america\matamorosxtcl\tzdata\america\mazatlanxtcl\tzdata\america\mendozaxtcl\tzdata\america\menomineextcl\tzdata\america\meridaxtcl\tzdata\america\metlakatlaxtcl\tzdata\america\mexico_cityxtcl\tzdata\america\miquelonxtcl\tzdata\america\monctonxtcl\tzdata\america\monterreyxtcl\tzdata\america\montevideoxtcl\tzdata\america\montrealxtcl\tzdata\america\montserratxtcl\tzdata\america\nassauxtcl\tzdata\america\new_yorkxtcl\tzdata\america\nipigonxtcl\tzdata\america\nomextcl\tzdata\america\noronhaxtcl\tzdata\america\north_dakota\beulahxtcl\tzdata\america\north_dakota\centerxtcl\tzdata\america\north_dakota\new_salemxtcl\tzdata\america\ojinagaxtcl\tzdata\america\panamaxtcl\tzdata\america\pangnirtungxtcl\tzdata\america\paramariboxtcl\tzdata\america\phoenixxtcl\tzdata\america\port-au-princextcl\tzdata\america\port_of_spainxtcl\tzdata\america\porto_acrextcl\tzdata\america\porto_velhoxtcl\tzdata\america\puerto_ricoxtcl\tzdata\america\punta_arenasxtcl\tzdata\america\rainy_riverxtcl\tzdata\america\rankin_inletxtcl\tzdata\america\recifextcl\tzdata\america\reginaxtcl\tzdata\america\resolutextcl\tzdata\america\rio_brancoxtcl\tzdata\america\rosarioxtcl\tzdata\america\santa_isabelxtcl\tzdata\america\santaremxtcl\tzdata\america\santiagoxtcl\tzdata\america\santo_domingoxtcl\tzdata\america\sao_pauloxtcl\tzdata\america\scoresbysundxtcl\tzdata\america\shiprockxtcl\tzdata\america\sitkaxtcl\tzdata\america\st_barthelemyxtcl\tzdata\america\st_johnsxtcl\tzdata\america\st_kittsxtcl\tzdata\america\st_luciaxtcl\tzdata\america\st_thomasxtcl\tzdata\america\st_vincentxtcl\tzdata\america\swift_currentxtcl\tzdata\america\tegucigalpaxtcl\tzdata\america\thulextcl\tzdata\america\thunder_bayxtcl\tzdata\america\tijuanaxtcl\tzdata\america\torontoxtcl\tzdata\america\tortolaxtcl\tzdata\america\vancouverxtcl\tzdata\america\virginxtcl\tzdata\america\whitehorsextcl\tzdata\america\winnipegxtcl\tzdata\america\yakutatxtcl\tzdata\america\yellowknifextcl\tzdata\antarctica\caseyxtcl\tzdata\antarctica\davisxtcl\tzdata\antarctica\dumontdurvillextcl\tzdata\antarctica\macquariextcl\tzdata\antarctica\mawsonxtcl\tzdata\antarctica\mcmurdoxtcl\tzdata\antarctica\palmerxtcl\tzdata\antarctica\rotheraxtcl\tzdata\antarctica\south_polextcl\tzdata\antarctica\syowaxtcl\tzdata\antarctica\trollxtcl\tzdata\antarctica\vostokxtcl\tzdata\arctic\longyearbyenxtcl\tzdata\asia\adenxtcl\tzdata\asia\almatyxtcl\tzdata\asia\ammanxtcl\tzdata\asia\anadyrxtcl\tzdata\asia\aqtauxtcl\tzdata\asia\aqtobextcl\tzdata\asia\ashgabatxtcl\tzdata\asia\ashkhabadxtcl\tzdata\asia\atyrauxtcl\tzdata\asia\baghdadxtcl\tzdata\asia\bahrainxtcl\tzdata\asia\bakuxtcl\tzdata\asia\bangkokxtcl\tzdata\asia\barnaulxtcl\tzdata\asia\beirutxtcl\tzdata\asia\bishkekxtcl\tzdata\asia\bruneixtcl\tzdata\asia\calcuttaxtcl\tzdata\asia\chitaxtcl\tzdata\asia\choibalsanxtcl\tzdata\asia\chongqingxtcl\tzdata\asia\chungkingxtcl\tzdata\asia\colomboxtcl\tzdata\asia\daccaxtcl\tzdata\asia\damascusxtcl\tzdata\asia\dhakaxtcl\tzdata\asia\dilixtcl\tzdata\asia\dubaixtcl\tzdata\asia\dushanbextcl\tzdata\asia\famagustaxtcl\tzdata\asia\gazaxtcl\tzdata\asia\harbinxtcl\tzdata\asia\hebronxtcl\tzdata\asia\ho_chi_minhxtcl\tzdata\asia\hong_kongxtcl\tzdata\asia\hovdxtcl\tzdata\asia\irkutskxtcl\tzdata\asia\istanbulxtcl\tzdata\asia\jakartaxtcl\tzdata\asia\jayapuraxtcl\tzdata\asia\jerusalemxtcl\tzdata\asia\kabulxtcl\tzdata\asia\kamchatkaxtcl\tzdata\asia\karachixtcl\tzdata\asia\kashgarxtcl\tzdata\asia\kathmanduxtcl\tzdata\asia\katmanduxtcl\tzdata\asia\khandygaxtcl\tzdata\asia\kolkataxtcl\tzdata\asia\krasnoyarskxtcl\tzdata\asia\kuala_lumpurxtcl\tzdata\asia\kuchingxtcl\tzdata\asia\kuwaitxtcl\tzdata\asia\macaoxtcl\tzdata\asia\macauxtcl\tzdata\asia\magadanxtcl\tzdata\asia\makassarxtcl\tzdata\asia\manilaxtcl\tzdata\asia\muscatxtcl\tzdata\asia\nicosiaxtcl\tzdata\asia\novokuznetskxtcl\tzdata\asia\novosibirskxtcl\tzdata\asia\omskxtcl\tzdata\asia\oralxtcl\tzdata\asia\phnom_penhxtcl\tzdata\asia\pontianakxtcl\tzdata\asia\pyongyangxtcl\tzdata\asia\qatarxtcl\tzdata\asia\qyzylordaxtcl\tzdata\asia\rangoonxtcl\tzdata\asia\riyadhxtcl\tzdata\asia\saigonxtcl\tzdata\asia\sakhalinxtcl\tzdata\asia\samarkandxtcl\tzdata\asia\seoulxtcl\tzdata\asia\shanghaixtcl\tzdata\asia\singaporextcl\tzdata\asia\srednekolymskxtcl\tzdata\asia\taipeixtcl\tzdata\asia\tashkentxtcl\tzdata\asia\tbilisixtcl\tzdata\asia\tehranxtcl\tzdata\asia\tel_avivxtcl\tzdata\asia\thimbuxtcl\tzdata\asia\thimphuxtcl\tzdata\asia\tokyoxtcl\tzdata\asia\tomskxtcl\tzdata\asia\ujung_pandangxtcl\tzdata\asia\ulaanbaatarxtcl\tzdata\asia\ulan_batorxtcl\tzdata\asia\urumqixtcl\tzdata\asia\ust-neraxtcl\tzdata\asia\vientianextcl\tzdata\asia\vladivostokxtcl\tzdata\asia\yakutskxtcl\tzdata\asia\yangonxtcl\tzdata\asia\yekaterinburgxtcl\tzdata\asia\yerevanxtcl\tzdata\atlantic\azoresxtcl\tzdata\atlantic\bermudaxtcl\tzdata\atlantic\canaryxtcl\tzdata\atlantic\cape_verdextcl\tzdata\atlantic\faeroextcl\tzdata\atlantic\faroextcl\tzdata\atlantic\jan_mayenxtcl\tzdata\atlantic\madeiraxtcl\tzdata\atlantic\reykjavikxtcl\tzdata\atlantic\south_georgiaxtcl\tzdata\atlantic\st_helenaxtcl\tzdata\atlantic\stanleyxtcl\tzdata\australia\actxtcl\tzdata\australia\adelaidextcl\tzdata\australia\brisbanextcl\tzdata\australia\broken_hillxtcl\tzdata\australia\canberraxtcl\tzdata\australia\curriextcl\tzdata\australia\darwinxtcl\tzdata\australia\euclaxtcl\tzdata\australia\hobartxtcl\tzdata\australia\lhixtcl\tzdata\australia\lindemanxtcl\tzdata\australia\lord_howextcl\tzdata\australia\melbournextcl\tzdata\australia\nswxtcl\tzdata\australia\northxtcl\tzdata\australia\perthxtcl\tzdata\australia\queenslandxtcl\tzdata\australia\southxtcl\tzdata\australia\sydneyxtcl\tzdata\australia\tasmaniaxtcl\tzdata\australia\victoriaxtcl\tzdata\australia\westxtcl\tzdata\australia\yancowinnaxtcl\tzdata\brazil\acrextcl\tzdata\brazil\denoronhaxtcl\tzdata\brazil\eastxtcl\tzdata\brazil\westxtcl\tzdata\cetxtcl\tzdata\cst6cdtxtcl\tzdata\canada\atlanticxtcl\tzdata\canada\centralxtcl\tzdata\canada\east-saskatchewanxtcl\tzdata\canada\easternxtcl\tzdata\canada\mountainxtcl\tzdata\canada\newfoundlandxtcl\tzdata\canada\pacificxtcl\tzdata\canada\saskatchewanxtcl\tzdata\canada\yukonxtcl\tzdata\chile\continentalxtcl\tzdata\chile\easterislandxtcl\tzdata\cubaxtcl\tzdata\eetxtcl\tzdata\estxtcl\tzdata\est5edtxtcl\tzdata\egyptxtcl\tzdata\eirextcl\tzdata\etc\gmtxtcl\tzdata\etc\gmt+0xtcl\tzdata\etc\gmt+1xtcl\tzdata\etc\gmt+10xtcl\tzdata\etc\gmt+11xtcl\tzdata\etc\gmt+12xtcl\tzdata\etc\gmt+2xtcl\tzdata\etc\gmt+3xtcl\tzdata\etc\gmt+4xtcl\tzdata\etc\gmt+5xtcl\tzdata\etc\gmt+6xtcl\tzdata\etc\gmt+7xtcl\tzdata\etc\gmt+8xtcl\tzdata\etc\gmt+9xtcl\tzdata\etc\gmt-0xtcl\tzdata\etc\gmt-1xtcl\tzdata\etc\gmt-10xtcl\tzdata\etc\gmt-11xtcl\tzdata\etc\gmt-12xtcl\tzdata\etc\gmt-13xtcl\tzdata\etc\gmt-14xtcl\tzdata\etc\gmt-2xtcl\tzdata\etc\gmt-3xtcl\tzdata\etc\gmt-4xtcl\tzdata\etc\gmt-5xtcl\tzdata\etc\gmt-6xtcl\tzdata\etc\gmt-7xtcl\tzdata\etc\gmt-8xtcl\tzdata\etc\gmt-9xtcl\tzdata\etc\gmt0xtcl\tzdata\etc\greenwichxtcl\tzdata\etc\uctxtcl\tzdata\etc\utcxtcl\tzdata\etc\universalxtcl\tzdata\etc\zuluxtcl\tzdata\europe\amsterdamxtcl\tzdata\europe\andorraxtcl\tzdata\europe\astrakhanxtcl\tzdata\europe\athensxtcl\tzdata\europe\belfastxtcl\tzdata\europe\belgradextcl\tzdata\europe\berlinxtcl\tzdata\europe\bratislavaxtcl\tzdata\europe\brusselsxtcl\tzdata\europe\bucharestxtcl\tzdata\europe\budapestxtcl\tzdata\europe\busingenxtcl\tzdata\europe\chisinauxtcl\tzdata\europe\copenhagenxtcl\tzdata\europe\dublinxtcl\tzdata\europe\gibraltarxtcl\tzdata\europe\guernseyxtcl\tzdata\europe\helsinkixtcl\tzdata\europe\isle_of_manxtcl\tzdata\europe\istanbulxtcl\tzdata\europe\jerseyxtcl\tzdata\europe\kaliningradxtcl\tzdata\europe\kievxtcl\tzdata\europe\kirovxtcl\tzdata\europe\lisbonxtcl\tzdata\europe\ljubljanaxtcl\tzdata\europe\londonxtcl\tzdata\europe\luxembourgxtcl\tzdata\europe\madridxtcl\tzdata\europe\maltaxtcl\tzdata\europe\mariehamnxtcl\tzdata\europe\minskxtcl\tzdata\europe\monacoxtcl\tzdata\europe\moscowxtcl\tzdata\europe\nicosiaxtcl\tzdata\europe\osloxtcl\tzdata\europe\parisxtcl\tzdata\europe\podgoricaxtcl\tzdata\europe\praguextcl\tzdata\europe\rigaxtcl\tzdata\europe\romextcl\tzdata\europe\samaraxtcl\tzdata\europe\san_marinoxtcl\tzdata\europe\sarajevoxtcl\tzdata\europe\saratovxtcl\tzdata\europe\simferopolxtcl\tzdata\europe\skopjextcl\tzdata\europe\sofiaxtcl\tzdata\europe\stockholmxtcl\tzdata\europe\tallinnxtcl\tzdata\europe\tiranextcl\tzdata\europe\tiraspolxtcl\tzdata\europe\ulyanovskxtcl\tzdata\europe\uzhgorodxtcl\tzdata\europe\vaduzxtcl\tzdata\europe\vaticanxtcl\tzdata\europe\viennaxtcl\tzdata\europe\vilniusxtcl\tzdata\europe\volgogradxtcl\tzdata\europe\warsawxtcl\tzdata\europe\zagrebxtcl\tzdata\europe\zaporozhyextcl\tzdata\europe\zurichxtcl\tzdata\gbxtcl\tzdata\gb-eirextcl\tzdata\gmtxtcl\tzdata\gmt+0xtcl\tzdata\gmt-0xtcl\tzdata\gmt0xtcl\tzdata\greenwichxtcl\tzdata\hstxtcl\tzdata\hongkongxtcl\tzdata\icelandxtcl\tzdata\indian\antananarivoxtcl\tzdata\indian\chagosxtcl\tzdata\indian\christmasxtcl\tzdata\indian\cocosxtcl\tzdata\indian\comoroxtcl\tzdata\indian\kerguelenxtcl\tzdata\indian\mahextcl\tzdata\indian\maldivesxtcl\tzdata\indian\mauritiusxtcl\tzdata\indian\mayottextcl\tzdata\indian\reunionxtcl\tzdata\iranxtcl\tzdata\israelxtcl\tzdata\jamaicaxtcl\tzdata\japanxtcl\tzdata\kwajaleinxtcl\tzdata\libyaxtcl\tzdata\metxtcl\tzdata\mstxtcl\tzdata\mst7mdtxtcl\tzdata\mexico\bajanortextcl\tzdata\mexico\bajasurxtcl\tzdata\mexico\generalxtcl\tzdata\nzxtcl\tzdata\nz-chatxtcl\tzdata\navajoxtcl\tzdata\prcxtcl\tzdata\pst8pdtxtcl\tzdata\pacific\apiaxtcl\tzdata\pacific\aucklandxtcl\tzdata\pacific\bougainvillextcl\tzdata\pacific\chathamxtcl\tzdata\pacific\chuukxtcl\tzdata\pacific\easterxtcl\tzdata\pacific\efatextcl\tzdata\pacific\enderburyxtcl\tzdata\pacific\fakaofoxtcl\tzdata\pacific\fijixtcl\tzdata\pacific\funafutixtcl\tzdata\pacific\galapagosxtcl\tzdata\pacific\gambierxtcl\tzdata\pacific\guadalcanalxtcl\tzdata\pacific\guamxtcl\tzdata\pacific\honoluluxtcl\tzdata\pacific\johnstonxtcl\tzdata\pacific\kiritimatixtcl\tzdata\pacific\kosraextcl\tzdata\pacific\kwajaleinxtcl\tzdata\pacific\majuroxtcl\tzdata\pacific\marquesasxtcl\tzdata\pacific\midwayxtcl\tzdata\pacific\nauruxtcl\tzdata\pacific\niuextcl\tzdata\pacific\norfolkxtcl\tzdata\pacific\noumeaxtcl\tzdata\pacific\pago_pagoxtcl\tzdata\pacific\palauxtcl\tzdata\pacific\pitcairnxtcl\tzdata\pacific\pohnpeixtcl\tzdata\pacific\ponapextcl\tzdata\pacific\port_moresbyxtcl\tzdata\pacific\rarotongaxtcl\tzdata\pacific\saipanxtcl\tzdata\pacific\samoaxtcl\tzdata\pacific\tahitixtcl\tzdata\pacific\tarawaxtcl\tzdata\pacific\tongatapuxtcl\tzdata\pacific\trukxtcl\tzdata\pacific\wakextcl\tzdata\pacific\wallisxtcl\tzdata\pacific\yapxtcl\tzdata\polandxtcl\tzdata\portugalxtcl\tzdata\rocxtcl\tzdata\rokxtcl\tzdata\singaporextcl\tzdata\systemv\ast4xtcl\tzdata\systemv\ast4adtxtcl\tzdata\systemv\cst6xtcl\tzdata\systemv\cst6cdtxtcl\tzdata\systemv\est5xtcl\tzdata\systemv\est5edtxtcl\tzdata\systemv\hst10xtcl\tzdata\systemv\mst7xtcl\tzdata\systemv\mst7mdtxtcl\tzdata\systemv\pst8xtcl\tzdata\systemv\pst8pdtxtcl\tzdata\systemv\yst9xtcl\tzdata\systemv\yst9ydtxtcl\tzdata\turkeyxtcl\tzdata\uctxtcl\tzdata\us\alaskaxtcl\tzdata\us\aleutianxtcl\tzdata\us\arizonaxtcl\tzdata\us\centralxtcl\tzdata\us\east-indianaxtcl\tzdata\us\easternxtcl\tzdata\us\hawaiixtcl\tzdata\us\indiana-starkextcl\tzdata\us\michiganxtcl\tzdata\us\mountainxtcl\tzdata\us\pacificxtcl\tzdata\us\pacific-newxtcl\tzdata\us\samoaxtcl\tzdata\utcxtcl\tzdata\universalxtcl\tzdata\w-suxtcl\tzdata\wetxtcl\tzdata\zuluxtcl\word.tclxtk\bgerror.tclxtk\button.tclxtk\choosedir.tclxtk\clrpick.tclxtk\comdlg.tclxtk\console.tclxtk\dialog.tclxtk\entry.tclxtk\focus.tclxtk\fontchooser.tclxtk\iconlist.tclxtk\icons.tclxtk\images\readmextk\images\logo.epsxtk\images\logo100.gifxtk\images\logo64.gifxtk\images\logolarge.gifxtk\images\logomed.gifxtk\images\pwrdlogo.epsxtk\images\pwrdlogo100.gifxtk\images\pwrdlogo150.gifxtk\images\pwrdlogo175.gifxtk\images\pwrdlogo200.gifxtk\images\pwrdlogo75.gifxtk\images\tai-ku.gifxtk\license.termsxtk\listbox.tclxtk\megawidget.tclxtk\menu.tclxtk\mkpsenc.tclxtk\msgbox.tclxtk\msgs\cs.msgxtk\msgs\da.msgxtk\msgs\de.msgxtk\msgs\el.msgxtk\msgs\en.msgxtk\msgs\en_gb.msgxtk\msgs\eo.msgxtk\msgs\es.msgxtk\msgs\fr.msgxtk\msgs\hu.msgxtk\msgs\it.msgxtk\msgs\nl.msgxtk\msgs\pl.msgxtk\msgs\pt.msgxtk\msgs\ru.msgxtk\msgs\sv.msgxtk\obsolete.tclxtk\optmenu.tclxtk\palette.tclxtk\panedwindow.tclxtk\pkgindex.tclxtk\safetk.tclxtk\scale.tclxtk\scrlbar.tclxtk\spinbox.tclxtk\tclindexxtk\tearoff.tclxtk\text.tclxtk\tk.tclxtk\tkfbox.tclxtk\ttk\alttheme.tclxtk\ttk\aquatheme.tclxtk\ttk\button.tclxtk\ttk\clamtheme.tclxtk\ttk\classictheme.tclxtk\ttk\combobox.tclxtk\ttk\cursors.tclxtk\ttk\defaults.tclxtk\ttk\entry.tclxtk\ttk\fonts.tclxtk\ttk\menubutton.tclxtk\ttk\notebook.tclxtk\ttk\panedwindow.tclxtk\ttk\progress.tclxtk\ttk\scale.tclxtk\ttk\scrollbar.tclxtk\ttk\sizegrip.tclxtk\ttk\spinbox.tclxtk\ttk\treeview.tclxtk\ttk\ttk.tclxtk\ttk\utils.tclxtk\ttk\vistatheme.tclxtk\ttk\wintheme.tclxtk\ttk\xptheme.tclxtk\unsupported.tclxtk\xmfbox.tclzpyz-00.pyz@/=i'c<3lmempe>$p&o<3" - Source: "00000000-00005988.00000002.121383.9CC50000.00000004.mdmp")4f:Ta58,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macIceland.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-14.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-13.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-10.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macTurkish.enc" which has been seen in the context of ransomware (Indicator: .ENC)50:Td8d,"OfficeLicenseManagementSystemv2.0.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI59882\*.* (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-1.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-kernel32-legacy-l1-1-1.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00005252) "OfficeLicenseManagementSystemv2.0.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00005252)51:T1e06,Found string "aesA"" (Indicator: "aes"; File: "Windows-Office License Management System v2.0.exe"), Found string "A path-like object to a zipfile or to a specific path inside" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25250000.00000004.mdmp"), Found string "a zipfile." (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25250000.00000004.mdmp"), Found string "'archivepath' must be a path-like object to a zipfile or to a specific path" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25250000.00000004.mdmp"), Found string "inside a zipfile. For example it can be '/tmp/myimport.zip' or" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25250000.00000004.mdmp"), Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25250000.00000004.mdmp"), Found string "Furthermore some packages expect files() to return either pathlib.Path or zipfile.Path e.g. " (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000000.118004.27090000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000001.119926.27090000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000002.121846.27090000.00000004.mdmp 00000000-00005252.00000003.128841.252C9000.00000004.mdmp 00000000-00005252.00000003.128841.27090000.00000004.mdmp"), Found string "C:\Users\nO1LAGy\AppData\Local\Temp\_MEI59882\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp 00000000-00005252.00000001.119926.26F80000.00000004.mdmp 00000000-00005252.00000002.121846.26F80000.00000004.mdmp 00000000-00005252.00000003.128841.26F80000.00000004.mdmp"), Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp 00000000-00005252.00000001.119926.26F80000.00000004.mdmp 00000000-00005252.00000002.121846.26F80000.00000004.mdmp 00000000-00005252.00000003.128841.26F80000.00000004.mdmp"), Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00005252.00000000.118004.26FC0000.00000004.mdmp 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp"), Found string "base64" (Indicator: "base64"; Source: "00000000-00005252.00000000.118004.26FC0000.00000004.mdmp 00000000-00005252.00000000.118004.3D8E1000.00000040.mdmp 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp 00000000-00005252.00000001.119926.27090000.00000004.mdmp 00000000-00005252.00000001.119926.28360000.00000004.mdmp 00000000-00005252.00000001.119926.28567000.00000004.mdmp 00000000-00005252.00000001.119926.3D8E1000.00000040.mdmp 00000000-00005252.00000002.121846.27090000.00000004.mdmp 00000000-00005252.00000002.121846.28360000.00000004.mdmp 00000000-00005252.00000002.121846.28567000.00000004.mdmp 00000000-00005252.00000002.121846.3D8E1000.00000040.mdmp 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp 00000000-00005252.00000003.128841.27090000.00000004.mdmp 00000000-00005252.00000003.128841.284D1000.00000004.mdmp 00000000-00005252.00000003.128841.28567000.00000004.mdmp 00000000-00005252.00000003.128841.3D8E1000.00000040.mdmp"), Found string "tinyaes" (Indicator: "aes"; Source: "00000000-00005252.00000000.118004.26FC0000.00000004.mdmp 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp"), Found string "_aesmod" (Indicator: "aes"; Source: "00000000-00005252.00000000.118004.26FC0000.00000004.mdmp 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp"), Found string "Cipher.decrypt" (Indicator: ".decrypt"; Source: "00000000-00005252.00000000.118004.26FC0000.00000004.mdmp 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp"), Found string "WSAESOCKTNOSUPPORT" (Indicator: "aes"; Source: "00000000-00005252.00000000.118004.279E0000.00000004.mdmp 00000000-00005252.00000002.121846.279E0000.00000004.mdmp 00000000-00005252.00000003.128841.279E0000.00000004.mdmp"), Found string "WSAESTALE" (Indicator: "aes"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp 00000000-00005252.00000001.119926.27A20000.00000004.mdmp 00000000-00005252.00000003.128841.27A20000.00000004.mdmp"), Found string "WSAESHUTDOWN" (Indicator: "aes"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp 00000000-00005252.00000001.119926.27A20000.00000004.mdmp 00000000-00005252.00000003.128841.27A20000.00000004.mdmp"), Found string "email.base64mime" (Indicator: "base64"; Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp 00000000-00005252.00000001.119926.28760000.00000004.mdmp 00000000-00005252.00000002.121846.28760000.00000004.mdmp 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp 00000000-00005252.00000003.128841.28760000.00000004.mdmp"), Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp"), Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp"), Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.27BF0000.00000004.mdmp 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp"), Found string "_make_zipfile" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.27BF0000.00000004.mdmp 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp"), Found string "is_zipfile" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.27BF0000.00000004.mdmp 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp"), Found string "_unpack_zipfile" (Indicator: "zipfile"; Source: "00000000-00005252.00000000.118004.27BF0000.00000004.mdmp 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp"), Found string "_unpack_tarfile" (Indicator: "tarfile"; Source: "00000000-00005252.00000000.118004.27BF0000.00000004.mdmp 00000000-00005252.00000002.121846.27BF0000.00000004.mdmp 00000000-00005252.00000003.128841.27BF0000.00000004.mdmp")52:T605,Found string "Get-ChildItem -Path $yol -Filter "*.lnk" -Recurse | Where-Object { $_.Name -match "Word|Excel|PowerPoint|Outlook|Access|Publisher|OneNote|Office" } | Remove-Item -Force" (Indicator: "Where-Object"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Get-ChildItem -Path $reg | ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" (Indicator: "Where-Object"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Office"} | Invoke-WmiMethod -Name "Uninstall"" (Indicator: "Where-Object"; Source: "00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp")53:T6b3,Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00005252.00000000.118004.27050000.00000004.mdmp, 00000000-00005252.00000001.119926.27050000.00000004.mdmp, 00000000-00005252.00000002.121846.27050000.00000004.mdmp, 00000000-00005252.00000003.128841.27050000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00005252.00000000.118004.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp") Found string "where the first item is the layout name, and the other" (Indicator: "where "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found string "where ``T1`` and ``T2`` are type variables. To use these type variables" (Indicator: "where "; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found string "where it would otherwise cause confusion." (Indicator: "where "; Source: "00000000-00005252.00000000.118004.27FF0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FF0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FF0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FF0000.00000004.mdmp")54:Ta52,Found string "Get-ChildItem -Path $yol -Filter "*.lnk" -Recurse | Where-Object { $_.Name -match "Word|Excel|PowerPoint|Outlook|Access|Publisher|OneNote|Office" } | Remove-Item -Force" (Indicator: "Get-ChildItem"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Get-ChildItem -Path $reg | ForEach-Object {" (Indicator: "Get-ChildItem"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$isim = (Get-ItemProperty -Path $_.PSPath -Name "DisplayName").DisplayName" (Indicator: "Get-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$users = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object { $_.Name -match "^HKEY_USERS\\S-1-5-21-[\d\-]+$" }" (Indicator: "Get-ChildItem"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$usersDirs = Get-ChildItem -Path "C:\Users" -Directory" (Indicator: "Get-ChildItem"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "$apps = Get-WmiObject -Query "SELECT * FROM SoftwareLicensingProduct WHERE ApplicationId='0ff1ce15-a989-479d-af46-f275c6370663' AND PartialProductKey IS NOT NULL"" (Indicator: "Get-WmiObject"; Source: "00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp") Found string "Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Office"} | Invoke-WmiMethod -Name "Uninstall"" (Indicator: "Get-WmiObject"; Source: "00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp")55:T684,Found string "have_password" (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.43DA1000.00000040.mdmp, 00000000-00005252.00000002.121846.440E1000.00000040.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.43DA1000.00000040.mdmp, 00000000-00005252.00000003.128841.440E1000.00000040.mdmp") Found string "_NetlocResultMixinBase.password" (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp") Found string "as OpenSSL's PKCS5_PBKDF2_HMAC for short passwords and much faster" (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.28240000.00000004.mdmp") Found string "for long passwords." (Indicator: "password"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.28240000.00000004.mdmp")56:T57e,"$reg_yollari = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp 00000000-00005252.00000001.119926.25250000.00000004.mdmp 00000000-00005252.00000002.121846.25250000.00000004.mdmp 00000000-00005252.00000003.128841.25306000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000001.119926.2A760000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.2A760000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.2A760000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005252.00000000.118004.27E70000.00000004.mdmp 00000000-00005252.00000001.119926.28AE0000.00000004.mdmp 00000000-00005252.00000002.121846.27E70000.00000004.mdmp 00000000-00005252.00000002.121846.28AE0000.00000004.mdmp 00000000-00005252.00000003.128841.27E70000.00000004.mdmp 00000000-00005252.00000003.128841.28AE0000.00000004.mdmp57:Tf0b,Found string "Route attribute access on a class to __getattr__." (Indicator: "route"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.252C9000.00000004.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00005252.00000000.118004.271D0000.00000004.mdmp, 00000000-00005252.00000001.119926.271D0000.00000004.mdmp, 00000000-00005252.00000001.119926.28930000.00000004.mdmp, 00000000-00005252.00000002.121846.271D0000.00000004.mdmp, 00000000-00005252.00000002.121846.28930000.00000004.mdmp, 00000000-00005252.00000003.128841.271D0000.00000004.mdmp, 00000000-00005252.00000003.128841.28930000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00005252.00000000.118004.27A20000.00000004.mdmp, 00000000-00005252.00000000.118004.3D8E1000.00000040.mdmp, 00000000-00005252.00000001.119926.27090000.00000004.mdmp, 00000000-00005252.00000001.119926.27A20000.00000004.mdmp, 00000000-00005252.00000001.119926.28360000.00000004.mdmp, 00000000-00005252.00000001.119926.28567000.00000004.mdmp, 00000000-00005252.00000001.119926.3D8E1000.00000040.mdmp, 00000000-00005252.00000002.121846.27090000.00000004.mdmp, 00000000-00005252.00000002.121846.28360000.00000004.mdmp, 00000000-00005252.00000002.121846.28567000.00000004.mdmp, 00000000-00005252.00000002.121846.288F0000.00000004.mdmp, 00000000-00005252.00000002.121846.3D8E1000.00000040.mdmp, 00000000-00005252.00000003.128841.27090000.00000004.mdmp, 00000000-00005252.00000003.128841.27A20000.00000004.mdmp, 00000000-00005252.00000003.128841.284D1000.00000004.mdmp, 00000000-00005252.00000003.128841.28567000.00000004.mdmp, 00000000-00005252.00000003.128841.288F0000.00000004.mdmp, 00000000-00005252.00000003.128841.3D8E1000.00000040.mdmp") Found string "gethostname() -- return the current hostname" (Indicator: "hostname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found string "gethostbyname() -- map a hostname to its IP number" (Indicator: "hostname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found string "gethostbyaddr() -- map an IP number or hostname to DNS info" (Indicator: "hostname"; Source: "00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp") Found string "ipconfig" (Indicator: "ipconfig"; Source: "00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp") Found string "tasklist | findstr /i "OfficeClickToRun.exe"" (Indicator: "tasklist"; Source: "00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp") Found string "seem to be the same for all version numbering classes; and route" (Indicator: "route"; Source: "00000000-00005252.00000000.118004.27FF0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FF0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FF0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FF0000.00000004.mdmp")58:Tdb1,Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows-OfficeLicenseManagementSystemv2.0.exe" (Indicator: "\Device\"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.26D00000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.26D00000.00000004.mdmp, 00000000-00005252.00000001.119926.28360000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.26D00000.00000004.mdmp, 00000000-00005252.00000002.121846.28360000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.26D00000.00000004.mdmp, 00000000-00005252.00000003.128841.284D1000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000000.118004.26D00000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.26D00000.00000004.mdmp, 00000000-00005252.00000001.119926.28360000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.26D00000.00000004.mdmp, 00000000-00005252.00000002.121846.28360000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.26D00000.00000004.mdmp, 00000000-00005252.00000003.128841.284D1000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp, 00000000-00005252.00000001.119926.26F80000.00000004.mdmp, 00000000-00005252.00000001.119926.28525000.00000004.mdmp, 00000000-00005252.00000002.121846.26F80000.00000004.mdmp, 00000000-00005252.00000002.121846.28525000.00000004.mdmp, 00000000-00005252.00000003.128841.26F80000.00000004.mdmp, 00000000-00005252.00000003.128841.28525000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005252.00000000.118004.26F80000.00000004.mdmp, 00000000-00005252.00000001.119926.26F80000.00000004.mdmp, 00000000-00005252.00000001.119926.28525000.00000004.mdmp, 00000000-00005252.00000002.121846.26F80000.00000004.mdmp, 00000000-00005252.00000002.121846.28525000.00000004.mdmp, 00000000-00005252.00000003.128841.26F80000.00000004.mdmp, 00000000-00005252.00000003.128841.28525000.00000004.mdmp")59:Ta4e,Found string "Set-ItemProperty -Path $hklm_signin -Name "SignInOptions" -Value 3 -Type DWord" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Set-ItemProperty -Path $hklm_oem -Name "OOBEMode" -Value "OEM" -Type String" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (Test-Path $hklm_c2r) { Set-ItemProperty -Path $hklm_c2r -Name "UpdatesEnabled" -Value "False" -Type String }" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Set-ItemProperty -Path $hklm_lic -Name "UpdatePromptBehavior" -Value 1 -Type DWord" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Set-ItemProperty -Path "$regPath\FirstRun" -Name "disable" -Value 1 -Type DWord" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Set-ItemProperty -Path "$regPath\FirstRun" -Name "BootedRTM" -Value 1 -Type DWord" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "Set-ItemProperty -Path "$regPath\Common\General" -Name "ShownFirstRunOptin" -Value 1 -Type DWord" (Indicator: "Set-ItemProperty"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")5a:Tb60,"OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS-OFFICELICENSEMANAGEMENTSYSTEMV2.0.EXE"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "OfficeLicenseManagementSystemv2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")5b:T1a6b,"OfficeLicenseManagementSystemv2.0.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "66040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70022020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DC461030DD3F9000DDB80010E013E010E963D010EBACD000F05DE001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B0129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300335CC470336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300252A7AA00547A520054B7DC00552D200355358303555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A01625AC6016396770063BE7A0364D419016530540165C9760365D36800664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00965DD200971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A3B24E03A3D40803A3E71501A4580200A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C9262D01C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3C7AF00D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03EF798B00F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503ED00060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50234BBEF0036D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E7403633E99006363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F9302928271009283510192C41401930547019369C70096390B01994664019AC657019B56A4009C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B0755E00B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BC5F1A01BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703CE8A8003D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E6B92B01E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F03ADD00F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100")5c:T745,Found string "if (-not (Test-Path $hklm_signin)) { New-Item -Path $hklm_signin -Force | Out-Null }" (Indicator: "Out-Null"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_oem)) { New-Item -Path $hklm_oem -Force | Out-Null }" (Indicator: "Out-Null"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path $hklm_lic)) { New-Item -Path $hklm_lic -Force | Out-Null }" (Indicator: "Out-Null"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\FirstRun")) { New-Item -Path "$regPath\FirstRun" -Force | Out-Null }" (Indicator: "Out-Null"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp") Found string "if (-not (Test-Path "$regPath\Common\General")) { New-Item -Path "$regPath\Common\General" -Force | Out-Null }" (Indicator: "Out-Null"; Source: "00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp")5d:T12c6,"setup.exe" has type "PE32 executable for MS Windows 5.02 (console) Intel i386 5 sections"- Location: [%TEMP%\_MEI59882\setup.exe]- [targetUID: 00000000-00005988] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI59882\ucrtbase.dll]- [targetUID: 00000000-00005252] "python37.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python37.dll]- [targetUID: 00000000-00005252] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libcrypto-1_1.dll]- [targetUID: 00000000-00005252] "tcl86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tcl86t.dll]- [targetUID: 00000000-00005252] "tk86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tk86t.dll]- [targetUID: 00000000-00005252] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libssl-1_1.dll]- [targetUID: 00000000-00005252] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI59882\VCRUNTIME140.dll]- [targetUID: 00000000-00005252] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python3.dll]- [targetUID: 00000000-00005252] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00005988]5e:T561,Found string "fread" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL) Found string "fwrite" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL) Found string "fseek" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL) Found string "fopen" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL) Found string "calloc" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL) Found string "AreFileApisANSI" (Source: Windows-Office License Management System v2.0.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: Windows-Office License Management System v2.0.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: Windows-Office License Management System v2.0.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: Windows-Office License Management System v2.0.exe, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: Windows-Office License Management System v2.0.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: Windows-Office License Management System v2.0.exe, API is part of module: MSVCRT.DLL)5f:T487,"python3.dll" was detected as "Morphine v1.2 (DLL)" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-errorhandling-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-namedpipe-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-synch-l1-2-0.dll" was detected as "Microsoft Visual C++ vx.x DLL"60:T835,"Windows-Office License Management System v2.0.exe" has resource with unusual entropy "RT_ICON:7.7041771890988135" "Windows-Office License Management System v2.0.exe" has resource with unusual entropy "RT_ICON:7.906475366932596" "Windows-Office License Management System v2.0.exe" has resource with unusual entropy "RT_ICON:7.93814848801145" "Windows-Office License Management System v2.0.exe" has resource with unusual entropy "RT_ICON:7.992009096902403" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.310676709433455" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.292787829549274" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.309295886610722" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.226669232222649" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.277644568552751" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.328973696522413" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.26309546906964" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.3159866835353995" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.364019110546675" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.284054206380798" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.294914524458541" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.347511053485226" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.349961986933813" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.311211764746378" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.352088681843076" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.326438894408367" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.244360821675658" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.386472092446262" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.3487784545422485" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.300224498560491" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.332472305284741"61:T3200,"setup.exe" has type "PE32 executable for MS Windows 5.02 (console) Intel i386 5 sections"- Location: [%TEMP%\_MEI59882\setup.exe]- [targetUID: 00000000-00005988] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI59882\ucrtbase.dll]- [targetUID: 00000000-00005252] "python37.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python37.dll]- [targetUID: 00000000-00005252] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libcrypto-1_1.dll]- [targetUID: 00000000-00005252] "tcl86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tcl86t.dll]- [targetUID: 00000000-00005252] "tk86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\tk86t.dll]- [targetUID: 00000000-00005252] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\libssl-1_1.dll]- [targetUID: 00000000-00005252] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI59882\VCRUNTIME140.dll]- [targetUID: 00000000-00005252] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\python3.dll]- [targetUID: 00000000-00005252] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00005988] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00005988] "sppcplus64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 (stripped to external PDB) 8 sections"- Location: [%TEMP%\_MEI59882\sppcplus64.dll]- [targetUID: 00000000-00005988] "sppcplus32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 (stripped to external PDB) 8 sections"- Location: [%TEMP%\_MEI59882\sppcplus32.dll]- [targetUID: 00000000-00005988] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\unicodedata.pyd]- [targetUID: 00000000-00005252] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%TEMP%\_MEI59882\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00005252] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_lzma.pyd]- [targetUID: 00000000-00005252] "md.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\charset_normalizer\md.pyd]- [targetUID: 00000000-00005252] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_ctypes.pyd]- [targetUID: 00000000-00005252] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_ssl.pyd]- [targetUID: 00000000-00005252] "cd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\charset_normalizer\cd.pyd]- [targetUID: 00000000-00005252] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_bz2.pyd]- [targetUID: 00000000-00005252] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_socket.pyd]- [targetUID: 00000000-00005252] "_tkinter.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_tkinter.pyd]- [targetUID: 00000000-00005252] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_hashlib.pyd]- [targetUID: 00000000-00005252] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\_queue.pyd]- [targetUID: 00000000-00005252] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI59882\select.pyd]- [targetUID: 00000000-00005252]62:T51d,"ucrtbase.dll" claimed CRC 12522230 while the actual is CRC 1377994 "python37.dll" claimed CRC 1377994 while the actual is CRC 1260858 "python3.dll" claimed CRC 142957 while the actual is CRC 116327 "api-ms-win-crt-math-l1-1-0.dll" claimed CRC 116327 while the actual is CRC 39092 "api-ms-win-crt-string-l1-1-0.dll" claimed CRC 39092 while the actual is CRC 70355 "api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 70355 while the actual is CRC 70429 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 70429 while the actual is CRC 66313 "api-ms-win-core-file-l1-1-0.dll" claimed CRC 66313 while the actual is CRC 88268 "api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 88268 while the actual is CRC 62509 "api-ms-win-core-processthreads-l1-1-0.dll" claimed CRC 62509 while the actual is CRC 46779 "api-ms-win-core-errorhandling-l1-1-0.dll" claimed CRC 46779 while the actual is CRC 31025 "api-ms-win-core-namedpipe-l1-1-0.dll" claimed CRC 31025 while the actual is CRC 27746 "api-ms-win-crt-process-l1-1-0.dll" claimed CRC 27746 while the actual is CRC 44348 "api-ms-win-crt-time-l1-1-0.dll" claimed CRC 44348 while the actual is CRC 84749 "api-ms-win-crt-heap-l1-1-0.dll" claimed CRC 84749 while the actual is CRC 84312 "api-ms-win-core-synch-l1-2-0.dll" claimed CRC 84312 while the actual is CRC 6695263:Tbd0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIo0lEQVR4XtWXe1DWVRrHa/MWooiUtiZQWik3DRBUUEDugq5AgnHVQBFIEBAQxHqFXhRMQLC4CwpyVeQmKgICKqIEZNaqSa4z5Wzb7Ew1s1O72zbz2ed9YQtJra1/dp+ZZ87hd87z/X7Pc55zzstjj/3PG/Cb/FeZBHrX/drgn5oa6xeLGTtR+qHiAZ9/TgDjnXH98T7yfTzeD/0H2ugE27ouNrZdZ3PbB0ScHeD1jmtEXrxO7OWbxA/eJvmDYd68eYeU4c/YM/ypur/r2jDxQ7fZfukGUReuESExW08PqTGCzl3HqvHSCPlDRagGFAqcyq/hVXGBgBODeBR34HG4E6+jPayv7sXnxFX8WoYI6vqIwMFP8Ll+F19xVT/w/Ef4Ng/ic/wK6ysvSUw360o6WFfUjv/xQdZXXUK1MBXHA0XYKrrUH90KOvAs68U+vQ6n3Gbc3mnGveA0a44KWEsfbt3v43L1I/yHPqZk+B5ptz7Fe+AWa/o+ZF33NTyar7C29Bzu+a24HWrGKacZ+321eB3pxb24cyTDo1zjbGS/7LNacTjQhH1GPc5ZDbjkNuEqAtyF3KPnA+L6P6ZIVt124zPy37vD65Ji5XvDxA7cxr/nOm7tA6xp6sM17xTOOY04Z57Efv9xHA8045h9aiQDKq6fkIvZlnVhl9aIfVqdtDU4SBbsD5zAOf8UK89cJafvJq1DfyKl40O2dN8i8PId5mWdwfRQG2sLzxHVOkBQaz8Op6/i9G6Lmli1ejtltRpzRUYTKo6xnPcL6LqLtfIkNopKVu6pwCb1GDZpVTjkNWPV2kfxlRuE1b+H3+W75P71b+T8+Svqvvia+n98h2FaA6YJFQS3DbCyqRe73EZslJXYpBwTrHI1prWyARXHIwUse6sOq52lLEsowWp3GVaKo9gerMey8SKHeqSyy6XAzg8z+P33dH35Dbe//Y6Lf/8O45RazGNL8anvxaVzkFVFZ1iqik8WrPjDI5jKOvQfJUBfasDsrVqWRheyZHs+FvGFWCaVYL23EvO68yja+4kq6sCmZoiOb/5J/Wdf0f3519Td+5J5UUVCdAS3qh6cOwYIk5OyYq+IiskTrDzBLMBMWYuK46ECbGXQILkK09AcTMNyeTkyF9OYd1my6zDmx9rxPtnDwboejNNbqfv2X1T95WuGJOaC+ILYIuxl+6wr2jE91on/yX42VF/CYGs25mE5vLwlB4PdVag4RinHCBj9Y6O0+kllPOOxB8Ogt1kcmolJ+EFMkkpxqunBovUy+2Ur/PafRDOiGqP0DoySj7JEeYylimps3m7BsqkHk4KzbOv8kLU1fSwMPoBR0H41pv6uMlQcjxTw3O5yZrgkoeOehL5PKi9szsal8CyuJW2Y13SzrLKNglO9vJpai4ZzBhONQ9D3zcT6rWaMCxoxKm0jsLaX8N5hFmW2oOudqsZSYT73cwIipdVLPIK24050XBPQdErAILYERzliz0trmtWEcf0FFh9uIedcP3kdQ1gqW1m2/zQL8hukUHvZ2NCvvkkNlPXoRRUzw20XM10SBDPhl2VAL6GQGXY70HGKQ2NVLCvSallx8DRPRR5mTlQBuiJwzvFu3AqbqL7xBc41NzHOqGHNtU/wa30fWyE3SatnUXIFs4KymLk6EW2HWDWm/s6SnxegG5mH1spotO2i0bKPRfe1g/g1DGD3zhlMUk+wOKOBJU39eJe2omj7o1yv3ZiVt7H64i1sittZkFjBgoQjzA3LQ2edQsh3CHm0GlMvKu8hAsacgtmbMpluFYmWzTZ1oM7aN3lxVyUrck/jUNKJ45Fu7M69j6dkILXrNp6VVzDLb8S18QrW++oxVlTxQnwZ2m7JP5ILlpZgPiPYKo6xnPeZanCWj5Jplq+LiHCmrxAhttHoBufwbGQJz24v4TkBX1TZxeqcEyS135EH5zxGOXUsKu1k/vZifr8xU4ouWZ3BadaR4irycMGMUGP/KOABprqlnhLlU81C0bTYwvTlEWivjGTy8m3M8kyR7chiflQhC4vkock+TsK5T7Hf28XCtHLmJBYxU4pWvWqbKCYtCWW2fQw6Eq9hHqLGfHrNbmzv3n2EAHkotKRYpi4OkeMViK4Uz/6a81ht3Mdks81MsgyXuohjjlxOximlvFbUh3PaReYnFvJ0SAaaSyOYYrmVCaYhzHPfye7iU/gnlzDB0B9NwdRalYh+2aMEbCxj2rIoNIw3McUoAO0lW3hVwHe+20jcO3LMAtOY6xSLhmzNjMhs5mzLlq3JRkt86soodF3iWLBuF57x+aRXyW2YXMzTy8J40jgADaMgpi2PQcUxnvcHM5Rfj5qLI5i8wJ8nDf2YKK2u/XZeWB1PwBuHSavsIFaEBCkrWP9mGe5Ztbhn1uIal4+JtwKvhALi85vUc+c7xuAcnsVLrnE8MX89UxZKFswjUHGM5x01hXpg2svhagGTX/JlwjwfVm/LISS9GteoXAzXJmEtWXCVb3/YkUeICNmUWo6nEJtvSGHlpnSW+ytZFXqAgD1H2Z57khclY7/T92SKYKqwx3Ldb7YjH6cvlqIx2spEPS8mvyginvfmJcnAK4kFRBe2ECCktmFvsyYhn+Uh6cxz28ny4HS83ijGS1LuHnsIX0Uppq+8wRMS+7ieBxNFgIZRKNPNIkeIR7keYCMDU422iOJgJs33lUz4MUHax8Vnyd6bBu7DcEMqdjH5BOY0sFReO4e4Qhx3yHMrYzMswmTrAnhi3gYmyQJUi3hyYTAqzLEcj7CRCRoGW9Aw3MxUE6leiwh05ETM9NiNtl8as7blMisxn6f2FDF7bzmzkwrQCTuAtq8SHY8kZjpEq2M0F4WgYRCMCmss9n9lOlYZ6PnlMVdRh+HZy1jcu4eFXCYO4h6j7Q8uYwuPtjM3plgdo4odj/fLzdv7NwSPs9+Opbo++ek/ng/z/8z/f7B/A4PNxGA9RpEzAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1793044092567,"unified_at":"2026-10-26T19:48:12.567Z","metadata":{"hashes":{"sha256":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","sha1":"5acbb0950cc54708bac337f0b12796e08a5e67a5","md5":"d2b71ed56e75c4ac68ddb57ef1ae5899","sha512":"26cb5bec00fbfc5c5490fe929b7f83cffe6a5d921b492558475796ea5751b1a076f0a78d5d90d15d28349e2a7b762fc1b65ecd605a7f6f248a5e5c6d1a1a3894","ssdeep":"196608:FP+UCNTwhLh1cMcz2UoVypBKVbBfrnjk0ax8ZDcSMb0R1lE0fdbLAWv7OmTTTSBC:lTPLh6lRiVbjaxwgxb0RvtLAyO8TTSBC","ssdeep_chunks":["196608:FP+UCNT","196608:P+UCNTw","196608:+UCNTwh","196608:UCNTwhL","196608:CNTwhLh","196608:NTwhLh1","196608:TwhLh1c","196608:whLh1cM","196608:hLh1cMc","196608:Lh1cMcz","196608:h1cMcz2","196608:1cMcz2U","196608:cMcz2Uo","196608:Mcz2UoV","196608:cz2UoVy","196608:z2UoVyp","196608:2UoVypB","196608:UoVypBK","196608:oVypBKV","196608:VypBKVb","196608:ypBKVbB","196608:pBKVbBf","196608:BKVbBfr","196608:KVbBfrn","196608:VbBfrnj","196608:bBfrnjk","196608:Bfrnjk0","196608:frnjk0a","196608:rnjk0ax","196608:njk0ax8","196608:jk0ax8Z","196608:k0ax8ZD","196608:0ax8ZDc","196608:ax8ZDcS","196608:x8ZDcSM","196608:8ZDcSMb","196608:ZDcSMb0","196608:DcSMb0R","196608:cSMb0R1","196608:SMb0R1l","196608:Mb0R1lE","196608:b0R1lE0","196608:0R1lE0f","196608:R1lE0fd","196608:1lE0fdb","196608:lE0fdbL","196608:E0fdbLA","196608:0fdbLAW","196608:fdbLAWv","196608:dbLAWv7","196608:bLAWv7O","196608:LAWv7Om","196608:AWv7OmT","196608:Wv7OmTT","196608:v7OmTTT","196608:7OmTTTS","196608:OmTTTSB","196608:mTTTSBC","393216:FP+UCNT","393216:P+UCNTw","393216:+UCNTwh","393216:UCNTwhL","393216:CNTwhLh","393216:NTwhLh1","393216:TwhLh1c","393216:whLh1cM","393216:hLh1cMc","393216:Lh1cMcz","393216:h1cMcz2","393216:1cMcz2U","393216:cMcz2Uo","393216:Mcz2UoV","393216:cz2UoVy","393216:z2UoVyp","393216:2UoVypB","393216:UoVypBK","393216:oVypBKV","393216:VypBKVb","393216:ypBKVbB","393216:pBKVbBf","393216:BKVbBfr","393216:KVbBfrn","393216:VbBfrnj","393216:bBfrnjk","393216:Bfrnjk0","393216:frnjk0a","393216:rnjk0ax","393216:njk0ax8","393216:jk0ax8Z","393216:k0ax8ZD","393216:0ax8ZDc","393216:ax8ZDcS","393216:x8ZDcSM","393216:8ZDcSMb","393216:ZDcSMb0","393216:DcSMb0R","393216:cSMb0R1","393216:SMb0R1l","393216:Mb0R1lE","393216:b0R1lE0","393216:0R1lE0f","393216:R1lE0fd","393216:1lE0fdb","393216:lE0fdbL","393216:E0fdbLA","393216:0fdbLAW","393216:fdbLAWv","393216:dbLAWv7","393216:bLAWv7O","393216:LAWv7Om","393216:AWv7OmT","393216:Wv7OmTT","393216:v7OmTTT","393216:7OmTTTS","393216:OmTTTSB","393216:mTTTSBC","196608:lTPLh6l","196608:TPLh6lR","196608:PLh6lRi","196608:Lh6lRiV","196608:h6lRiVb","196608:6lRiVbj","196608:lRiVbja","196608:RiVbjax","196608:iVbjaxw","196608:Vbjaxwg","196608:bjaxwgx","196608:jaxwgxb","196608:axwgxb0","196608:xwgxb0R","196608:wgxb0Rv","196608:gxb0Rvt","196608:xb0RvtL","196608:b0RvtLA","196608:0RvtLAy","196608:RvtLAyO","196608:vtLAyO8","196608:tLAyO8T","196608:LAyO8TT","196608:AyO8TTS","196608:yO8TTSB","196608:O8TTSBC"],"imphash":"0b5552dccd9d0a834cea55c0c8fc05be","pehash":"7e255663968a59aefd5dc599d586cb9ad3aaf344"},"file_info":{"file_name":"Windows-Office License Management System v2.0.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":12494976,"entropy":8,"compile_timestamp":"2026-10-17T20:13:42","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793043691000,"last_seen":1793043691000,"last_multi_scan":1793043691000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":7,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":165936,"raw_size":166400},{"name":".rdata","virtual_address":"0x2a000","virtual_size":76510,"raw_size":76800},{"name":".data","virtual_address":"0x3d000","virtual_size":66552,"raw_size":3584},{"name":".pdata","virtual_address":"0x4e000","virtual_size":8352,"raw_size":8704},{"name":"_RDATA","virtual_address":"0x51000","virtual_size":348,"raw_size":512},{"name":".rsrc","virtual_address":"0x52000","virtual_size":81476,"raw_size":81920},{"name":".reloc","virtual_address":"0x66000","virtual_size":1880,"raw_size":2048}],"section_names":[".text",".rdata",".data",".pdata","_RDATA",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":80,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":87},"sandbox_signatures":{"informative_count":204,"suspicious_count":16,"malicious_count":2,"total":222},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Writes a PE file header to disc"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains system command string that can search for a specific process"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"informative","value":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with low confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-18","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"Failed to get address for Tcl_CreateThread\n\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\", Heuristic match: \"z\nactivation.py\", Heuristic match: \"%s%c%s.py\", Heuristic match: \"ov.sr\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"Failed to get address for Tcl_CreateThread\n\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"\toyOid\" (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$28","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"FindResourceW\" with parameter \"140708455764048\" - (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"LoadResource with parameter {'hModule': '140708454662144', 'hResInfo': '140708456161072'}\" (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005252.00000000.118004.279E0000.00000004.mdmp, 00000000-00005252.00000002.121846.279E0000.00000004.mdmp, 00000000-00005252.00000003.128841.279E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - lib%s\\.\\S+); Source: \"00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp\")\n Found string - (-?(?:0|[1-9]\\d*))(\\.\\d+)?([eE][-+]?\\d+)?; Source: \"00000000-00005252.00000000.118004.280F0000.00000004.mdmp, 00000000-00005252.00000001.119926.280F0000.00000004.mdmp, 00000000-00005252.00000002.121846.280F0000.00000004.mdmp, 00000000-00005252.00000003.128841.280F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"OfficeLicenseManagementSystemv2.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"OfficeLicenseManagementSystemv2.0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"OfficeLicenseManagementSystemv2.0.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"Cipher.decrypt\" (Indicator: \".decrypt\"; Source: \"00000000-00005252.00000000.118004.26FC0000.00000004.mdmp, 00000000-00005252.00000001.119926.26FC0000.00000004.mdmp, 00000000-00005252.00000003.128841.26FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found api reference \"CryptGenRandom on Windows).\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.28240000.00000004.mdmp, 00000000-00005252.00000001.119926.28240000.00000004.mdmp, 00000000-00005252.00000002.121846.28240000.00000004.mdmp, 00000000-00005252.00000002.121846.28280000.00000004.mdmp, 00000000-00005252.00000003.128841.28240000.00000004.mdmp, 00000000-00005252.00000003.128841.28280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"tasklist | findstr /i \"OfficeClickToRun.exe\"\" (Source: \"00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"EnumSystemFirmwareTables\"; File: \"api-ms-win-core-sysinfo-l1-2-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"$reg_yollari = @(\"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\", \"HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\")\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005252.00000000.118004.25250000.00000004.mdmp, 00000000-00005252.00000001.119926.25250000.00000004.mdmp, 00000000-00005252.00000002.121846.25250000.00000004.mdmp, 00000000-00005252.00000003.128841.25306000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000001.119926.2A760000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.2A760000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.2A760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"$apps = Get-WmiObject -Query \"SELECT * FROM SoftwareLicensingProduct WHERE ApplicationId='0ff1ce15-a989-479d-af46-f275c6370663' AND PartialProductKey IS NOT NULL\"\" (Source: \"00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp\")\n Found string \"Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match \"Microsoft Office\"} | Invoke-WmiMethod -Name \"Uninstall\"\" (Source: \"00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005988)\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005252)\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005988)\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00005252)\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Windows-Office License Management System v2.0.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$30","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"Windows-Office License Management System v2.0.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005252.00000000.118004.27C30000.00000004.mdmp, 00000000-00005252.00000002.121846.27C30000.00000004.mdmp, 00000000-00005252.00000003.128841.27C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"OfficeLicenseManagementSystemv2.0.exe\" queried token user identity (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$33","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI59882\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"api-ms-win-core-file-l2-1-0.dll\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$34","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\OfficeLicenseManagementSystemv2.0.exe\"\" - (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WmiMethod -Path $app.__PATH -Name UninstallProductKey -ArgumentList $app.PartialProductKey\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp\")\n Found string \"Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match \"Microsoft Office\"} | Invoke-WmiMethod -Name \"Uninstall\"\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: python37.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: tcl86t.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: tk86t.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libssl-1_1.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005252.00000000.118004.27C30000.00000004.mdmp, 00000000-00005252.00000002.121846.27C30000.00000004.mdmp, 00000000-00005252.00000003.128841.27C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$38","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: ucrtbase.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5988:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"SM0:5988:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5252:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5252:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5252:120:WilError_03\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"Local\\SM0:5252:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"SM0:5252:304:WilStaging_02\"\n Process OfficeLicenseManagementSystemv2.0.exe created mutex with name \"SM0:5252:120:WilError_03\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3a","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3b","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"ping@lfw.org\"\n Pattern match: \"nadeem.vawda@gmail.com\"\n Pattern match: \"yselivanov@sprymix.com\"\n Pattern match: \"info@egenix.com\"\n Pattern match: \"bob@redivi.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666\" (Indicator: \"stackoverflow.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"OfficeLicenseManagementSystemv2.0.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 67EB0000\n \"OfficeLicenseManagementSystemv2.0.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 67EE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"OfficeLicenseManagementSystemv2.0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 692F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3ab67f97f0000@ntdll.dll\"\n \"220023000000000038a3ab67f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$40","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Windows-Office License Management System v2.0.exe\" has an executable section named \".text\"\n \"ucrtbase.dll\" has an executable section named \".text\"\n \"ucrtbase.dll\" has an executable section named \"fothk\"\n \"python37.dll\" has an executable section named \"UPX0\"\n \"python37.dll\" has an executable section named \"UPX1\"\n \"libcrypto-1_1.dll\" has an executable section named \"UPX0\"\n \"libcrypto-1_1.dll\" has an executable section named \"UPX1\"\n \"tcl86t.dll\" has an executable section named \"UPX0\"\n \"tcl86t.dll\" has an executable section named \"UPX1\"\n \"tk86t.dll\" has an executable section named \"UPX0\"\n \"tk86t.dll\" has an executable section named \"UPX1\"\n \"libssl-1_1.dll\" has an executable section named \"UPX0\"\n \"libssl-1_1.dll\" has an executable section named \"UPX1\"\n \"VCRUNTIME140.dll\" has an executable section named \".text\"\n \"python3.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$41","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$42","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x122600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x2a4000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x123000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x24e000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x114000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$43","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\OfficeLicenseManagementSystemv2.0.exe\" [Source: 00000000-00005988-00000BC0-564499232]\n Observed system executable string:\"\"%WINDIR%\\OfficeLicenseManagementSystemv2.0.exe\"\" [Source: 00000000-00005988-00000C47-16688466589]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"OfficeLicenseManagementSystemv2.0.exe\" (UID: 00000000-00005252) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI59882\", USERDNSDOMAIN=\"5FgtbWYieVrwpr3\"\"\n Process \"OfficeLicenseManagementSystemv2.0.exe\" (UID: 00000000-00005252) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"OfficeLicenseManagementSystemv2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OfficeLicenseManagementSystemv2.0.exe\" (UID: 00000000-00005252)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"OfficeLicenseManagementSystemv2.0.exe\" (UID: 00000000-00005252)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Erdem Castle, O=Erdem Castle, OU=Development\" (SHA1: C8:04:7B:C0:FA:FA:60:14:7A:27:76:73:4B:1B:BA:47:B6:9E:0A:32; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"OfficeLicenseManagementSystemv2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI59882\\VCRUNTIME140.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"OfficeLicenseManagementSystemv2.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$47","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"OfficeLicenseManagementSystemv2.0.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI59882\\_bz2.pyd\"\n \"OfficeLicenseManagementSystemv2.0.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI59882\\_ctypes.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"OfficeLicenseManagementSystemv2.0.exe\" queries basic process information of the \"C:\\Windows-OfficeLicenseManagementSystemv2.0.exe\" (UID: 5988)\n \"OfficeLicenseManagementSystemv2.0.exe\" queries basic process information of the \"C:\\Windows-OfficeLicenseManagementSystemv2.0.exe\" (UID: 5252)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"OfficeLicenseManagementSystemv2.0.exe\" reads file \"c:\\windows-officelicensemanagementsystemv2.0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4c","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"OfficeLicenseManagementSystemv2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei59882\\vcruntime140.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005252.00000000.118004.271D0000.00000004.mdmp, 00000000-00005252.00000001.119926.271D0000.00000004.mdmp, 00000000-00005252.00000001.119926.28930000.00000004.mdmp, 00000000-00005252.00000002.121846.271D0000.00000004.mdmp, 00000000-00005252.00000002.121846.28930000.00000004.mdmp, 00000000-00005252.00000003.128841.271D0000.00000004.mdmp, 00000000-00005252.00000003.128841.28930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"api-ms-win-core-memory-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"ipconfig\" (Indicator: \"ipconfig\"; Source: \"00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"xtcl\\msgs\\es_mx.msg\" [Source: 00000000-00005252.00000000.118004.25250000.00000004.mdmp\n 00000000-00005252.00000001.119926.25250000.00000004.mdmp\n 00000000-00005252.00000002.121846.25250000.00000004.mdmp\n 00000000-00005252.00000003.128841.25250000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.1.1.6\"\n \"2.7.2.2\"\n Potential IP \"123.45.67.89\" found in string \"inet_aton() -- convert IP addr string (123.45.67.89) to 32-bit packed format\"\n Potential IP \"123.45.67.89\" found in string \"inet_ntoa() -- convert 32-bit packed format IP to string (123.45.67.89)\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 activation.sls.microsoft.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 validation.sls.microsoft.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 officeclient.microsoft.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 nexus.officeapps.live.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 roaming.officeapps.live.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 office15client.microsoft.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 ols.officeapps.live.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 odc.officeapps.live.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 c.s-microsoft.com\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0 office.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetDCName\" which can \"return the name of the primary domain controller (PDC).\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"setup.exe\"\n YARA signature for AES encryption matched on process \"00000000-00005252\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"setup.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005252\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Ransomware/Banking","name":"The analysis extracted a file with a known ransomware suffix","description":"$4f","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"sftp\" (Indicator: \"sftp\") in Source: 00000000-00005252.00000000.118004.27A20000.00000004.mdmp\n 00000000-00005252.00000001.119926.27A20000.00000004.mdmp\n 00000000-00005252.00000003.128841.27A20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"api-ms-win-core-file-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Windows-Office License Management System v2.0.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ucrtbase.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"NetGetDCName\" in file \"Windows-Office License Management System v2.0.exe\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"OfficeLicenseManagementSystemv2.0.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 5F0E0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist | findstr /i \"OfficeClickToRun.exe\"\" (Indicator: \"tasklist \") in Source: 00000000-00005252.00000000.118004.27FB0000.00000004.mdmp\n 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp\n 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp\n 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostnamer\" (Indicator: \"gethostname\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp\")\n Found reference to API \"gethostname() -- return the current hostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005252.00000000.118004.28070000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.28070000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.28070000.00000004.mdmp, 00000000-00005252.00000003.128841.28070000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00005252.00000000.118004.27C70000.00000004.mdmp, 00000000-00005252.00000000.118004.44101000.00000040.mdmp, 00000000-00005252.00000001.119926.27C70000.00000004.mdmp, 00000000-00005252.00000001.119926.44101000.00000040.mdmp, 00000000-00005252.00000002.121846.27C70000.00000004.mdmp, 00000000-00005252.00000003.128841.27C7E000.00000004.mdmp, 00000000-00005252.00000003.128841.44101000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00005252.00000000.118004.27E70000.00000004.mdmp, 00000000-00005252.00000002.121846.27E70000.00000004.mdmp, 00000000-00005252.00000003.128841.27E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005252.00000000.118004.27BB0000.00000004.mdmp, 00000000-00005252.00000000.118004.443A1000.00000040.mdmp, 00000000-00005252.00000001.119926.27BB0000.00000004.mdmp, 00000000-00005252.00000001.119926.443A1000.00000040.mdmp, 00000000-00005252.00000003.128841.27BB0000.00000004.mdmp, 00000000-00005252.00000003.128841.443A1000.00000040.mdmp, 00000000-00005252.00000003.128841.443C8000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"tasklist | findstr /i \"OfficeClickToRun.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$55","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains system command string that can search for a specific process","description":"Observed string: \"tasklist | findstr /i \"OfficeClickToRun.exe\"\" [Source: 00000000-00005252.00000000.118004.27FB0000.00000004.mdmp\n 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp\n 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp\n 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-172","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; Source: \"00000000-00005252.00000000.118004.27FB0000.00000004.mdmp, 00000000-00005252.00000000.118004.280B0000.00000004.mdmp, 00000000-00005252.00000000.118004.28200000.00000004.mdmp, 00000000-00005252.00000000.118004.28240000.00000004.mdmp, 00000000-00005252.00000001.119926.27FB0000.00000004.mdmp, 00000000-00005252.00000001.119926.280B0000.00000004.mdmp, 00000000-00005252.00000001.119926.28200000.00000004.mdmp, 00000000-00005252.00000001.119926.28240000.00000004.mdmp, 00000000-00005252.00000002.121846.27FB0000.00000004.mdmp, 00000000-00005252.00000002.121846.280B0000.00000004.mdmp, 00000000-00005252.00000002.121846.28240000.00000004.mdmp, 00000000-00005252.00000003.128841.27FB0000.00000004.mdmp, 00000000-00005252.00000003.128841.280B0000.00000004.mdmp, 00000000-00005252.00000003.128841.28200000.00000004.mdmp, 00000000-00005252.00000003.128841.28240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005252)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Windows-Office License Management System v2.0.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Windows-Office License Management System v2.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"00000000-00005252.00000000.118004.25250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: Windows-Office License Management System v2.0.exe]\n Observed import api \"EqualSid\" which can \"test two security identifier (SID) values for equality\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"OfficeLicenseManagementSystemv2.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$5c","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$5f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"python37.dll\" has a section named \"UPX0\"\n \"python37.dll\" has a section named \"UPX1\"\n \"libcrypto-1_1.dll\" has a section named \"UPX0\"\n \"libcrypto-1_1.dll\" has a section named \"UPX1\"\n \"tcl86t.dll\" has a section named \"UPX0\"\n \"tcl86t.dll\" has a section named \"UPX1\"\n \"tk86t.dll\" has a section named \"UPX0\"\n \"tk86t.dll\" has a section named \"UPX1\"\n \"libssl-1_1.dll\" has a section named \"UPX0\"\n \"libssl-1_1.dll\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Windows-Office License Management System v2.0.exe\" has section name .rsrc with entropy \"7.976166531753225\"\n \"python37.dll\" has section name UPX1 with entropy \"7.999714342594575\"\n \"libcrypto-1_1.dll\" has section name UPX1 with entropy \"7.999713362104147\"\n \"tcl86t.dll\" has section name UPX1 with entropy \"7.9992712857877795\"\n \"tk86t.dll\" has section name UPX1 with entropy \"7.999340113653235\"\n \"libssl-1_1.dll\" has section name UPX1 with entropy \"7.996350673870009\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows-OfficeLicenseManagementSystemv2.0.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$60","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"OfficeLicenseManagementSystemv2.0.exe\" writes archive file \"%TEMP%\\_MEI59882\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"OfficeLicenseManagementSystemv2.0.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows-OfficeLicenseManagementSystemv2.0.exe\" (Handle: 608)\n \"OfficeLicenseManagementSystemv2.0.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows-OfficeLicenseManagementSystemv2.0.exe\" (Handle: 608)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"5\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"160107d4\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10b5c\"\n \"cx\": \"169478669\"\n \"cy\": \"109051904\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"144\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"145\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"OfficeLicenseManagementSystemv2.0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"OfficeLicenseManagementSystemv2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$62","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"python37.dll\" has an entrypoint in section \"UPX1\"\n \"libcrypto-1_1.dll\" has an entrypoint in section \"UPX1\"\n \"tcl86t.dll\" has an entrypoint in section \"UPX1\"\n \"tk86t.dll\" has an entrypoint in section \"UPX1\"\n \"libssl-1_1.dll\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateDirectoryW\n GetFileAttributesExW\n FindFirstFileExW\n GetModuleHandleW\n TerminateProcess\n GetTempPathW\n GetCommandLineA\n GetDriveTypeW\n DeleteFileW\n Sleep\n GetStartupInfoW\n GetCommandLineW\n IsDebuggerPresent\n LoadLibraryExW\n GetModuleFileNameW\n CreateProcessW\n UnhandledExceptionFilter\n CreateFileW\n GetModuleHandleExW\n FindNextFileW\n GetProcAddress\n GetFileSizeEx\n WriteFile\n OutputDebugStringW\n GetLogicalDrives\n VirtualAlloc\n VirtualProtect\n ExitThread\n CreateThread\n GetSystemInfo\n RegCloseKey\n LoadLibraryA\n send","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ucrtbase.dll\" claims program is from Fri Dec 17 01:47:12 2066\n \"api-ms-win-crt-math-l1-1-0.dll\" claims program is from Sun Oct 19 23:51:07 2070\n \"api-ms-win-crt-string-l1-1-0.dll\" claims program is from Sat May 18 16:36:08 2080\n \"api-ms-win-crt-stdio-l1-1-0.dll\" claims program is from Mon Feb 5 00:23:05 2103\n \"api-ms-win-core-file-l1-1-0.dll\" claims program is from Thu Sep 23 16:29:24 2032\n \"api-ms-win-crt-convert-l1-1-0.dll\" claims program is from Mon Sep 1 13:52:40 2042\n \"api-ms-win-core-processthreads-l1-1-0.dll\" claims program is from Tue Jan 23 01:17:01 2085\n \"api-ms-win-core-errorhandling-l1-1-0.dll\" claims program is from Sun Mar 1 18:34:01 2082\n \"api-ms-win-crt-time-l1-1-0.dll\" claims program is from Wed Jan 6 07:59:47 2094\n \"api-ms-win-crt-heap-l1-1-0.dll\" claims program is from Sat Jan 30 07:11:15 2077\n \"api-ms-win-core-synch-l1-2-0.dll\" claims program is from Sun Jun 26 04:26:19 1994","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}],"intel_graph":{"map":{"File:0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9":{"type":"File","value":"0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9"},"File:093470f798ac90e3f62e321b274973127590d99a3d6b692263d82fd77a0c090b":{"type":"File","value":"093470f798ac90e3f62e321b274973127590d99a3d6b692263d82fd77a0c090b"},"File:17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819":{"type":"File","value":"17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819"},"File:180efb69cdcace13681cdb061991e53c4de95495b15ebdee0a3316be4c7950ec":{"type":"File","value":"180efb69cdcace13681cdb061991e53c4de95495b15ebdee0a3316be4c7950ec"},"File:1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818":{"type":"File","value":"1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818"},"File:1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585":{"type":"File","value":"1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585"},"File:25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40":{"type":"File","value":"25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40"},"File:2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0":{"type":"File","value":"2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0"},"File:2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb":{"type":"File","value":"2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb"},"File:3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6":{"type":"File","value":"3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6"},"File:31682b09f641c14613322e486fa2c98f079290df477e2b4fbe15dbe42ecf077f":{"type":"File","value":"31682b09f641c14613322e486fa2c98f079290df477e2b4fbe15dbe42ecf077f"},"File:33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57":{"type":"File","value":"33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57"},"File:341e79c2382f212dc3b39a0525db381a32d99b5ec2c015a2f2156baee743aeac":{"type":"File","value":"341e79c2382f212dc3b39a0525db381a32d99b5ec2c015a2f2156baee743aeac"},"File:353e71ab37c28788a614188ba06d717581b21d6a117aaccbd4bb4cde3679ff29":{"type":"File","value":"353e71ab37c28788a614188ba06d717581b21d6a117aaccbd4bb4cde3679ff29"},"File:39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9":{"type":"File","value":"39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9"},"File:39163151c1a6137e786ff93c2644acadcd723f64c9d6fe0443ddc14ae964e173":{"type":"File","value":"39163151c1a6137e786ff93c2644acadcd723f64c9d6fe0443ddc14ae964e173"},"File:3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad":{"type":"File","value":"3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad"},"File:3e67b4412d651f549d172b0fa7d95d09d6c802846b4c8c0788d70c64eb305335":{"type":"File","value":"3e67b4412d651f549d172b0fa7d95d09d6c802846b4c8c0788d70c64eb305335"},"File:4294a9e7ea6c995f2ef1888e74df25e60b3ee654a448137baeafd8d625b4e860":{"type":"File","value":"4294a9e7ea6c995f2ef1888e74df25e60b3ee654a448137baeafd8d625b4e860"},"File:4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e":{"type":"File","value":"4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e"},"File:4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d":{"type":"File","value":"4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d"},"File:53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606":{"type":"File","value":"53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606"},"File:53b3989696d5d0ba8da17831966e18b7e1107a9562bcb12af3323ad18d3f3620":{"type":"File","value":"53b3989696d5d0ba8da17831966e18b7e1107a9562bcb12af3323ad18d3f3620"},"File:591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3":{"type":"File","value":"591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3"},"File:5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a":{"type":"File","value":"5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a"},"File:606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f":{"type":"File","value":"606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f"},"File:60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd":{"type":"File","value":"60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd"},"File:699293864d464bde6b59fd2b46b0446d2d5e7e12c58688685b59538a26aaa05f":{"type":"File","value":"699293864d464bde6b59fd2b46b0446d2d5e7e12c58688685b59538a26aaa05f"},"File:6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d":{"type":"File","value":"6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d"},"File:6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc":{"type":"File","value":"6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc"},"File:71f3500b55e5a8af0ea3ff26f81c0df2c960d8e3b5218c6c8c537c3e389778a3":{"type":"File","value":"71f3500b55e5a8af0ea3ff26f81c0df2c960d8e3b5218c6c8c537c3e389778a3"},"File:7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61":{"type":"File","value":"7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61"},"File:78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b":{"type":"File","value":"78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156":{"type":"File","value":"7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156"},"File:7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c":{"type":"File","value":"7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c"},"File:865209a2814aa07eb27918ab5dd0a1a47c760f52ceb35e2671b5eab2cb658902":{"type":"File","value":"865209a2814aa07eb27918ab5dd0a1a47c760f52ceb35e2671b5eab2cb658902"},"File:88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386":{"type":"File","value":"88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386"},"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea":{"type":"File","value":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9":{"type":"File","value":"8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9"},"File:91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3":{"type":"File","value":"91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3"},"File:93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989":{"type":"File","value":"93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989"},"File:99bcfc206a6172a685a1fb542e763a808196a50ab5a77b0030039930e1a77e29":{"type":"File","value":"99bcfc206a6172a685a1fb542e763a808196a50ab5a77b0030039930e1a77e29"},"File:9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db":{"type":"File","value":"9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db"},"File:9cbbda5d9b2ca1f9b14ef0ce6ff299009750026e6d6e543aa51d3eac0722bd3f":{"type":"File","value":"9cbbda5d9b2ca1f9b14ef0ce6ff299009750026e6d6e543aa51d3eac0722bd3f"},"File:9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f":{"type":"File","value":"9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f"},"File:9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1":{"type":"File","value":"9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1"},"File:a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6":{"type":"File","value":"a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6"},"File:a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6":{"type":"File","value":"a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6"},"File:b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e":{"type":"File","value":"b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e"},"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b":{"type":"File","value":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f":{"type":"File","value":"b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f"},"File:bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a":{"type":"File","value":"bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a"},"File:bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e":{"type":"File","value":"bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e"},"File:c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273":{"type":"File","value":"c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273"},"File:c388661f790889902b5a7b09968de1aff4db8e2f285a94db04bbcd4288cce1e2":{"type":"File","value":"c388661f790889902b5a7b09968de1aff4db8e2f285a94db04bbcd4288cce1e2"},"File:c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9":{"type":"File","value":"c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9"},"File:c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b":{"type":"File","value":"c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b"},"File:d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b":{"type":"File","value":"d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b"},"File:d2e51af2e490f1b68a34e2b35fe5a205502f8e5689b0cd73955d5bca9228cbf3":{"type":"File","value":"d2e51af2e490f1b68a34e2b35fe5a205502f8e5689b0cd73955d5bca9228cbf3"},"File:d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8":{"type":"File","value":"d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8"},"File:d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac":{"type":"File","value":"d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac"},"File:ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4":{"type":"File","value":"ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4"},"File:efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb":{"type":"File","value":"efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb"},"File:f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc":{"type":"File","value":"f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc"},"File:fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429":{"type":"File","value":"fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429"}},"chains":[{"id":"1564363470652017532","root":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b"}],"verdict":{"verdict":"unknown"}},{"id":"1564363470681377661","root":"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"sandbox_files","root":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","edges":[{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:9cbbda5d9b2ca1f9b14ef0ce6ff299009750026e6d6e543aa51d3eac0722bd3f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:3e67b4412d651f549d172b0fa7d95d09d6c802846b4c8c0788d70c64eb305335"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:865209a2814aa07eb27918ab5dd0a1a47c760f52ceb35e2671b5eab2cb658902"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:99bcfc206a6172a685a1fb542e763a808196a50ab5a77b0030039930e1a77e29"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:699293864d464bde6b59fd2b46b0446d2d5e7e12c58688685b59538a26aaa05f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:353e71ab37c28788a614188ba06d717581b21d6a117aaccbd4bb4cde3679ff29"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:71f3500b55e5a8af0ea3ff26f81c0df2c960d8e3b5218c6c8c537c3e389778a3"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:d2e51af2e490f1b68a34e2b35fe5a205502f8e5689b0cd73955d5bca9228cbf3"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:4294a9e7ea6c995f2ef1888e74df25e60b3ee654a448137baeafd8d625b4e860"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:39163151c1a6137e786ff93c2644acadcd723f64c9d6fe0443ddc14ae964e173"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:31682b09f641c14613322e486fa2c98f079290df477e2b4fbe15dbe42ecf077f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:341e79c2382f212dc3b39a0525db381a32d99b5ec2c015a2f2156baee743aeac"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:093470f798ac90e3f62e321b274973127590d99a3d6b692263d82fd77a0c090b"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:180efb69cdcace13681cdb061991e53c4de95495b15ebdee0a3316be4c7950ec"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:53b3989696d5d0ba8da17831966e18b7e1107a9562bcb12af3323ad18d3f3620"},{"edge_kind":"extracted","from_key":"File:8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","to_key":"File:c388661f790889902b5a7b09968de1aff4db8e2f285a94db04bbcd4288cce1e2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":63,"files_written_count":239,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6adface9c958969f6d0696b3","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"Windows-Office License Management System v2.0.exe","analysis_start_time":"2026-10-26T19:41:32+00:00","indicators_count":{"informative":204,"suspicious":35,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}],"processes":[{"pid":5988,"ppid":0,"name":"OfficeLicenseManagementSystemv2.0.exe","command_line":"","sha256":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","normalized_path":"%WINDIR%\\OfficeLicenseManagementSystemv2.0.exe","uid":"00000000-00005988","icon":"$63"},{"pid":5252,"ppid":5988,"name":"OfficeLicenseManagementSystemv2.0.exe","command_line":"","sha256":"8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea","normalized_path":"%WINDIR%\\OfficeLicenseManagementSystemv2.0.exe","parent_uid":"00000000-00005988","uid":"00000000-00005252"}],"all_imported_dlls":["gdi32.dll","python37.dll","shell32.dll","logoncli.dll","msvcp140.dll","vcruntime140.dll","oleaut32.dll","netapi32.dll","KernelBase.dll","ws2_32.dll","vcruntime140_1.dll","combase.dll","version.dll","imm32.dll","cryptsp.dll","CoreUIComponents.dll","ntdll.dll","TextInputFramework.dll","msctf.dll","comctl32.dll","ole32.dll","userenv.dll","libcrypto-1_1.dll","crypt32.dll","mswsock.dll","IconCodecService.dll","kernel.appcore.dll","ntmarta.dll","win32u.dll","msvcrt.dll","tk86t.dll","dwmapi.dll","user32.dll","gdi32full.dll","shlwapi.dll","comdlg32.dll","netutils.dll","fltLib.dll","CoreMessaging.dll","bcrypt.dll","VxSSL64.dll","WindowsCodecs.dll","rpcrt4.dll","ucrtbase.dll","cryptbase.dll","python3.dll","uxtheme.dll","WinTypes.dll","TextShaping.dll","sechost.dll","bcryptprimitives.dll","IPHLPAPI.DLL","SHCore.dll","samcli.dll","libssl-1_1.dll","kernel32.dll","msvcp_win.dll","advapi32.dll","rsaenh.dll","tcl86t.dll","clbcatq.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b","sha256":"78df06927befe7772f2bad536228ec87eb26a12de863695c81781b1aad51396b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"VCRUNTIME140.dll","sha256":"3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"cacert.pem","sha256":"9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"libcrypto-1_1.dll","sha256":"9cbbda5d9b2ca1f9b14ef0ce6ff299009750026e6d6e543aa51d3eac0722bd3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"libssl-1_1.dll","sha256":"3e67b4412d651f549d172b0fa7d95d09d6c802846b4c8c0788d70c64eb305335","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"python3.dll","sha256":"d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"python37.dll","sha256":"865209a2814aa07eb27918ab5dd0a1a47c760f52ceb35e2671b5eab2cb658902","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"setup.exe","sha256":"99bcfc206a6172a685a1fb542e763a808196a50ab5a77b0030039930e1a77e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"tcl86t.dll","sha256":"699293864d464bde6b59fd2b46b0446d2d5e7e12c58688685b59538a26aaa05f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"tk86t.dll","sha256":"353e71ab37c28788a614188ba06d717581b21d6a117aaccbd4bb4cde3679ff29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"ucrtbase.dll","sha256":"2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_bz2.pyd","sha256":"71f3500b55e5a8af0ea3ff26f81c0df2c960d8e3b5218c6c8c537c3e389778a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_ctypes.pyd","sha256":"d2e51af2e490f1b68a34e2b35fe5a205502f8e5689b0cd73955d5bca9228cbf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_hashlib.pyd","sha256":"4294a9e7ea6c995f2ef1888e74df25e60b3ee654a448137baeafd8d625b4e860","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_lzma.pyd","sha256":"39163151c1a6137e786ff93c2644acadcd723f64c9d6fe0443ddc14ae964e173","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_queue.pyd","sha256":"31682b09f641c14613322e486fa2c98f079290df477e2b4fbe15dbe42ecf077f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_socket.pyd","sha256":"341e79c2382f212dc3b39a0525db381a32d99b5ec2c015a2f2156baee743aeac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_ssl.pyd","sha256":"093470f798ac90e3f62e321b274973127590d99a3d6b692263d82fd77a0c090b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"_tkinter.pyd","sha256":"180efb69cdcace13681cdb061991e53c4de95495b15ebdee0a3316be4c7950ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-fibers-l1-1-0.dll","sha256":"91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-fibers-l1-1-1.dll","sha256":"fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-kernel32-legacy-l1-1-1.dll","sha256":"a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-sysinfo-l1-2-0.dll","sha256":"2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"sppcplus32.dll","sha256":"53b3989696d5d0ba8da17831966e18b7e1107a9562bcb12af3323ad18d3f3620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"sppcplus64.dll","sha256":"c388661f790889902b5a7b09968de1aff4db8e2f285a94db04bbcd4288cce1e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\_tkinter.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\charset_normalizer\\cd.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\charset_normalizer\\md.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\pyarmor_runtime_000000\\pyarmor_runtime.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\python37.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl86t.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tk86t.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\.DS_Store","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\fonts\\CustomTkinter_shapes_font.otf","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\fonts\\Roboto\\Roboto-Medium.ttf","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\fonts\\Roboto\\Roboto-Regular.ttf","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\icons\\.DS_Store","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\icons\\CustomTkinter_icon_Windows.ico","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\themes\\blue.json","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\themes\\dark-blue.json","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\customtkinter\\assets\\themes\\green.json","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\icon.ico","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\setup.exe","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\sppcplus32.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\sppcplus64.dll","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl8\\8.4\\platform-1.0.14.tm","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl8\\8.4\\platform\\shell-1.1.4.tm","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl8\\8.5\\msgcat-1.6.1.tm","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl8\\8.5\\tcltest-2.5.0.tm","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl8\\8.6\\http-2.9.0.tm","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\history.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\init.tcl","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"path":"%TEMP%\\_MEI59882\\tcl\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5252:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"Local\\SM0:5252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"SM0:5252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]},{"name":"SM0:5252:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adface9c958969f6d0696b3"}]}]}},"report_ids":{"sandbox_job_ids":["6adface9c958969f6d0696b3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 8a4f593a0bfa… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8a4f593a0bfa…. Malware family: Win/malicious_confidence_70%. Threat score 80/100. 1/28 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 8a4f593a0bfa… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8a4f593a0bfa…. Malware family: Win/malicious_confidence_70%. Threat score 80/100. 1/28 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8a4f593a0bfa902c22ae0cae602b2bd20e1210d66bced534f922ea6a5fb806ea"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 8a4f593a0bfa… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8a4f593a0bfa…. Malware family: Win/malicious_confidence_70%. Threat score 80/100. 1/28 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L64","11",{}]]