26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T426,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 9f9c4d0f6644… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9f9c4d0f6644…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65"],"about":{"@type":"SoftwareApplication","name":"Application.exe","applicationCategory":["compressed","7zip"],"identifier":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c1,"Application.exe" called "RemoveDirectoryW" with parameter \\?\%TEMP%\pyp_5af271ab (UID: 00000000-00007016) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-build-tracker-lsg0ym7e (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-wkvr01wi (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-metadata-p0rnemm_ (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-6jv5tsa3 (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-ephem-wheel-cache-mdkvlq7n (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-install-7a8ixe1a (UID: 00000000-00008068) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-build-tracker-px5pcvl7 (UID: 00000000-00005676) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-unpack-0fhf_bnz (UID: 00000000-00005676) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-ephem-wheel-cache-o3zobeyb (UID: 00000000-00005676) "python.exe" called "RemoveDirectoryW" with parameter %TEMP%\pip-install-l8q5rznx (UID: 00000000-00005676)28:T404,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000260.00000001.195119.14CCA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000260.00000001.195119.14CCA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp")29:Tccc,Found string - \\.\DISPLAY1; Source: "00000000-00002516.00000000.196177.00114000.00000004.mdmp, 00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.00114000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.00114000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp")2a:T80d," "%TEMP%\mswu_0705" - (UID: 00000000-00006492), "wscript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\mswu_0533" - (UID: 00000000-00006492) "wscript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\mswu_0579" - (UID: 00000000-00006492), "cmd.exe" called "CreateProcessW" with parameter "py -3 -c "import sys;print(sys.executable)"" - (UID: 00000000-00003804)3a:T9a45," "%TEMP%\mswu_0705" [Source: 00000000-00006492-00000C47-4794071792], Observed system executable string:""%WINDIR%\System32\cmd.exe" /c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\mswu_0533" [Source: 00000000-00006492-00000C47-44851467855] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\mswu_0579" [Source: 00000000-00006492-00000C47-85882579885], Observed system executable string:"%WINDIR%\py.exe" [Source: 00000000-00003804-00000BC0-2095373197], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "ver"" [Source: 00000000-00008068-00000C47-12552124540]47:T1083,Process "Application.exe" (UID: 00000000-00007016) was launched with new environment variables: "PORTABLE_EXECUTABLE_FILE="C:\9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin.exe", PORTABLE_EXECUTABLE_APP_FILENAME="Application", USERDNSDOMAIN="DESKTOP-FVVF82A", PORTABLE_EXECUTABLE_DIR="C:"" Process "Application.exe" (UID: 00000000-00007016) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007180) was launched with new environment variables: "ORIGINAL_XDG_CURRENT_DESKTOP="undefined"" Process "cmd.exe" (UID: 00000000-00007180) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007180) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00000260) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001180) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "attrib.exe" (UID: 00000000-00008132) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007436) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00007716) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007876) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00007856) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007572) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "attrib.exe" (UID: 00000000-00007440) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "wscript.exe" (UID: 00000000-00006492) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00006420) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00006336) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "python.exe" (UID: 00000000-00006336) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00003580) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00003580) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00004748) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00004272) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003980) was launched with new environment variables: "PIP_DISABLE_PIP_VERSION_CHECK="1", PIP_NO_INPUT="1"" Process "cmd.exe" (UID: 00000000-00003980) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00008068) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00006036) was launched with missing environment variables: "PIP_DISABLE_PIP_VERSION_CHECK, PIP_NO_INPUT" Process "cmd.exe" (UID: 00000000-00006296) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00001244) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000620) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "python.exe" (UID: 00000000-00001420) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003736) was launched with new environment variables: "PIP_DISABLE_PIP_VERSION_CHECK="1", PIP_NO_INPUT="1"" Process "cmd.exe" (UID: 00000000-00003736) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"48:T4fb," "%TEMP%\\m ..." (UID: 00000000-00006420), Spawned process "python.exe" with commandline "-c "import sys;print(sys.executable)"" (UID: 00000000-00006336), Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003580), Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.e ..." (UID: 00000000-00004748), Spawned process "python.exe" with commandline "-c "import Crypto,windows"" (UID: 00000000-00004272), Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.e ..." (UID: 00000000-00003980), Spawned process "python.exe" with commandline "-m pip install --quiet --no-cache-dir pycryptodome PythonForWind ..." (UID: 00000000-00008068), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00002792), Spawned process "cmd.exe" with commandline "/c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\\m ..." (UID: 00000000-00006036) Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003708)4b:Tcc3,Spawned process "Application.exe" (UID: 00000000-00007016) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSy ..." (UID: 00000000-00007180) Spawned process "powershell.exe" with commandline "powershell -Command "(Get-CimInstance Win32_ComputerSystemProdu ..." (UID: 00000000-00000260) Spawned process "Application.exe" with commandline ""%APPDATA%\\Application" --gpu-preferences=UAAAAAAAAADgAAAMAAAAA ..." (UID: 00000000-00002516) Spawned process "Application.exe" with commandline ""%APPDATA%\\Application" --field-trial-handle=2216,i,75441035483 ..." (UID: 00000000-00002532) Spawned process "cmd.exe" with commandline "/d /s /c "attrib +h +s "%LOCALAPPDATA%\\Microsoft\\Windows\\Font ..." (UID: 00000000-00001180) Spawned process "attrib.exe" with commandline "attrib +h +s "%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\Micros ..." (UID: 00000000-00008132), Spawned process "cmd.exe" with commandline "/d /s /c "schtasks /query /tn "MicrosoftUpdateService_sys""" (UID: 00000000-00007436), Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00007716), Spawned process "cmd.exe" with commandline "/d /s /c "schtasks /create /tn "MicrosoftUpdateService_sys" /tr ..." (UID: 00000000-00007876) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "MicrosoftUpdateService_sys" /tr "\\"%LOCA ..." (UID: 00000000-00007856) Spawned process "cmd.exe" with commandline "/d /s /c "attrib +h "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Star ..." (UID: 00000000-00007572) Spawned process "attrib.exe" with commandline "attrib +h "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\P ..." (UID: 00000000-00007440), Spawned process "wscript.exe" with commandline "//B //Nologo "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\ ..." (UID: 00000000-00006492) Spawned process "cmd.exe" with commandline "/d /s /c "py -3 -c "import sys;print(sys.executable)""" (UID: 00000000-00003804) Spawned process "cmd.exe" with commandline "/c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\\m ..." (UID: 00000000-00006420), Spawned process "python.exe" with commandline "-c "import sys;print(sys.executable)"" (UID: 00000000-00006336), Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003580), Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.e ..." (UID: 00000000-00004748), Spawned process "python.exe" with commandline "-c "import Crypto,windows"" (UID: 00000000-00004272), Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.e ..." (UID: 00000000-00003980), Spawned process "python.exe" with commandline "-m pip install --quiet --no-cache-dir pycryptodome PythonForWind ..." (UID: 00000000-00008068), Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00002792), Spawned process "cmd.exe" with commandline "/c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\\m ..." (UID: 00000000-00006036) Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003708)4c:T5ef,The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 2D:B7:A4:8A:DA:E5:E3:67:FC:5A:91:EB:AC:CA:D7:21:EE:5B:0D:25; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 5A:AA:6B:59:12:47:15:3E:8E:ED:0D:5C:0D:6E:2C:53:9B:85:58:AE; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 14:A2:7E:AD:B7:75:19:AE:55:22:B9:40:CD:23:BF:A1:D3:7C:C6:CA; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 36:0A:76:32:A6:8F:B2:9C:C6:C1:C4:25:66:45:BA:D2:D2:88:66:84; see report for more information) The input sample is signed with a certificate issued by "CN=R13, O=Let's Encrypt, C=US" (SHA1: 17:D4:3B:A6:A8:55:DF:02:7A:7A:CA:77:A2:3B:50:D3:AB:25:AF:DB; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information)4d:T6d8a,"libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\libGLESv2.dll]- [targetUID: 00000000-00002516] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00002516] "Application.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 15 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\Application.exe]- [targetUID: 00000000-00002516] "libvips-42.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\libvips-42.dll]- [targetUID: 00000000-00006256] "MicrosoftUpdate.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Fonts\MicrosoftUpdate.exe]- [targetUID: 00000000-00007016] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\ffmpeg.dll]- [targetUID: 00000000-00002516] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00006256] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\libEGL.dll]- [targetUID: 00000000-00002516] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsoE891.tmp\nsis7z.dll]- [targetUID: 00000000-00006256] "libvips-cpp-8.17.3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\libvips-cpp-8.17.3.dll]- [targetUID: 00000000-00006256] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00006256] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsoE891.tmp\StdUtils.dll]- [targetUID: 00000000-00006256] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsoE891.tmp\System.dll]- [targetUID: 00000000-00000260] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\LICENSES.chromium.html]- [targetUID: 00000000-00006256] "sqlite3.c" has type "C source ASCII text"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c]- [targetUID: 00000000-00006256] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nsoE891.tmp\app-64.7z]- [targetUID: 00000000-00006256] "better_sqlite3.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node]- [targetUID: 00000000-00006256] "pythonforwindows-1.0.4-py3-none-any.whl" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Aug 14 2025 09:04:48 uncompressed size 8 method=deflate"- Location: [%TEMP%\pip-unpack-wkvr01wi\pythonforwindows-1.0.4-py3-none-any.whl]- [targetUID: 00000000-00008068] "node-screenshots.win32-x64-msvc.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-screenshots-win32-x64-msvc\node-screenshots.win32-x64-msvc.node]- [targetUID: 00000000-00006256] "sqlite3.h" has type "C source ASCII text"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h]- [targetUID: 00000000-00006256] "winerror.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winerror.py]- [targetUID: 00000000-00008068] "winstructs.py" has type "Python script ASCII text executable with very long lines (1537) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winstructs.py]- [targetUID: 00000000-00008068] "sharp-win32-x64.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\sharp-win32-x64.node]- [targetUID: 00000000-00006256] "ntstatus.py" has type "Python script ASCII text executable with very long lines (449) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\ntstatus.py]- [targetUID: 00000000-00008068] "winfuncs.py" has type "Python script ASCII text executable with very long lines (313) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winfuncs.py]- [targetUID: 00000000-00008068] "windef.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\windef.py]- [targetUID: 00000000-00008068] "vmdetector.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\vmdetector\build\Release\vmdetector.node]- [targetUID: 00000000-00006256] "interfaces.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\interfaces.py]- [targetUID: 00000000-00008068] "dpapi.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\build\Release\dpapi.node]- [targetUID: 00000000-00007016] "process.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\process.py]- [targetUID: 00000000-00008068] "debugger.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\debugger.py]- [targetUID: 00000000-00008068] "simple_x64.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_x64.py]- [targetUID: 00000000-00008068] "kernel32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\kernel32.py]- [targetUID: 00000000-00008068] "event_log.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\event_log.py]- [targetUID: 00000000-00008068] "simple_x86.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_x86.py]- [targetUID: 00000000-00008068] "advapi32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\advapi32.py]- [targetUID: 00000000-00008068] "security.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\security.py]- [targetUID: 00000000-00008068] "sqlite3ext.h" has type "C source ASCII text"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h]- [targetUID: 00000000-00006256] "symbols.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\symbols.py]- [targetUID: 00000000-00008068] "token.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\token.py]- [targetUID: 00000000-00008068] "winutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\winutils.py]- [targetUID: 00000000-00008068] "system.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\system.py]- [targetUID: 00000000-00008068] "alpc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\alpc.py]- [targetUID: 00000000-00008068] "certificate.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\certificate.py]- [targetUID: 00000000-00008068] "simple_arm64.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_arm64.py]- [targetUID: 00000000-00008068] "ntdll.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ntdll.py]- [targetUID: 00000000-00008068] "injection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\injection.py]- [targetUID: 00000000-00008068] "device_manager.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\device_manager.py]- [targetUID: 00000000-00008068] "wmi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\wmi.py]- [targetUID: 00000000-00008068] "registry.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\registry.py]- [targetUID: 00000000-00008068] "ndr.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\ndr.py]- [targetUID: 00000000-00008068] "pe_parse.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\pe_parse.py]- [targetUID: 00000000-00008068] "remotectypes.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\remotectypes.py]- [targetUID: 00000000-00008068] "event_trace.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\event_trace.py]- [targetUID: 00000000-00008068] "client.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\client.py]- [targetUID: 00000000-00008068] "syswow64.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\syswow64.py]- [targetUID: 00000000-00008068] "com.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\com.py]- [targetUID: 00000000-00008068] "crypt32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\crypt32.py]- [targetUID: 00000000-00008068] "network.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\network.py]- [targetUID: 00000000-00008068] "localdbg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\localdbg.py]- [targetUID: 00000000-00008068] "nativeutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\nativeutils.py]- [targetUID: 00000000-00008068] "exception.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\exception.py]- [targetUID: 00000000-00008068] "breakpoints.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\breakpoints.py]- [targetUID: 00000000-00008068] "dbghelp.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\dbghelp.py]- [targetUID: 00000000-00008068] "service.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\service.py]- [targetUID: 00000000-00008068] "object_manager.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\object_manager.py]- [targetUID: 00000000-00008068] "bits.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\bits.py]- [targetUID: 00000000-00008068] "handle.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\handle.py]- [targetUID: 00000000-00008068] "epmapper.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\epmapper.py]- [targetUID: 00000000-00008068] "wintrust.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\wintrust.py]- [targetUID: 00000000-00008068] "apisetmap.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\apisetmap.py]- [targetUID: 00000000-00008068] "wevtapi.py" has type "Python script ASCII text executable with CRLF line terminators"- [targetUID: 00000000-00008068] "cpuid.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\cpuid.py]- [targetUID: 00000000-00008068] "cryptmsg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\cryptmsg.py]- [targetUID: 00000000-00008068] "wininet.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\wininet.py]- [targetUID: 00000000-00008068] "encrypt_decrypt.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\encrypt_decrypt.py]- [targetUID: 00000000-00008068] "apiproxy.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apiproxy.py]- [targetUID: 00000000-00008068] "hooks.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\hooks.py]- [targetUID: 00000000-00008068] "improved_buffer.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\improved_buffer.py]- [targetUID: 00000000-00008068] "cfgmgr32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\cfgmgr32.py]- [targetUID: 00000000-00008068] "pipe.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\pipe.py]- [targetUID: 00000000-00008068] "pythonutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\pythonutils.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\__init__.py]- [targetUID: 00000000-00008068] "download.sh" has type "Bourne-Again shell script ASCII text executable"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh]- [targetUID: 00000000-00006256] "user32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\user32.py]- [targetUID: 00000000-00008068] "volume.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\volume.py]- [targetUID: 00000000-00008068] "setupapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\setupapi.py]- [targetUID: 00000000-00008068] "flag_31459921.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Apr 16 2026 04:31:52 uncompressed size 0 method=store"- [targetUID: N/A] "netapi32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\netapi32.py]- [targetUID: 00000000-00008068] "sign_verify.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\sign_verify.py]- [targetUID: 00000000-00008068] "better_sqlite3.cpp" has type "C source ASCII text"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp]- [targetUID: 00000000-00006256] "ws2_32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ws2_32.py]- [targetUID: 00000000-00008068] "native_function.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\native_function.py]- [targetUID: 00000000-00008068] "wintrust.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\wintrust.py]- [targetUID: 00000000-00008068] "sqlite3.gyp" has type "ASCII text"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp]- [targetUID: 00000000-00006256] "ole32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ole32.py]- [targetUID: 00000000-00008068] "error.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\error.py]- [targetUID: 00000000-00008068] "file.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\file.py]- [targetUID: 00000000-00008068] "version.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\version.py]- [targetUID: 00000000-00008068] "generation.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\generation.py]- [targetUID: 00000000-00008068] "winhttp.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\winhttp.py]- [targetUID: 00000000-00008068] "symboldbg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\symboldbg.py]- [targetUID: 00000000-00008068] "psapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\psapi.py]- [targetUID: 00000000-00008068] "flag.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\flag.py]- [targetUID: 00000000-00008068] "iphlpapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\iphlpapi.py]- [targetUID: 00000000-00008068] "dpapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\dpapi.py]- [targetUID: 00000000-00008068] "test.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\test.py]- [targetUID: 00000000-00008068] "hyperv.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\hyperv.py]- [targetUID: 00000000-00008068] "oleaut32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\oleaut32.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\__init__.py]- [targetUID: 00000000-00008068] "dnsapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\dnsapi.py]- [targetUID: 00000000-00008068] "shell32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\shell32.py]- [targetUID: 00000000-00008068] "ktmw32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ktmw32.py]- [targetUID: 00000000-00008068] "shlwapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\shlwapi.py]- [targetUID: 00000000-00008068] "virtdisk.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\virtdisk.py]- [targetUID: 00000000-00008068] "sqlite-error.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js]- [targetUID: 00000000-00007016] "ncrypt.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ncrypt.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\__init__.py]- [targetUID: 00000000-00008068] "tdh.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\tdh.py]- [targetUID: 00000000-00008068] "cryptui.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\cryptui.py]- [targetUID: 00000000-00008068] "oleacc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\oleacc.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\__init__.py]- [targetUID: 00000000-00008068] "catalog.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\catalog.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\__init__.py]- [targetUID: 00000000-00008068]4e:Ta4b," "$TEMP/source.zip" || exit 1echo "extracting source..."unzip "$TEMP/source.zip" -d "$TEMP" > /dev/null || exit 1cd "$TEMP/sqlite-src-$VERSION" || exit 1echo "configuring amalgamation..."sh configure > /dev/null || exit 1echo "building amalgamation..."make OPTIONS="$CFLAGS" sqlite3.c > /dev/null || exit 1echo "copying amalgamation..."cp sqlite3.c sqlite3.h sqlite3ext.h "$OUTPUT/" || exit 1echo "applying patches..."cd "$DEPS" || exit 1for patch in patches/*.patch; do # If a patch fails just skip it an move on. # By default `patch` tries to be clever and reverse the patch so we have to specify `--forward`. # If the patch fails we # don't write .orig and .rej files, so we have to specify `--no-backup-if-mismatch` and `--reject-file=-`. patch --batch --forward --no-backup-if-mismatch --reject-file=- -p2 < "$patch"doneecho "updating gyp configs..."GYP="$DEPS/defines.gypi"printf "# THIS FILE IS AUTOMATICALLY GENERATED BY deps/download.sh (DO NOT EDIT)\n\n{\n 'defines': [\n" > "$GYP"printf "$DEFINES" | sed -e "/^\s*$/d" -e "s/$.*$/ '\1',/" >> "$GYP"printf " ],\n}\n" >> "$GYP"echo "updating docs..."DOCS="$DEPS/../docs/compilation.md"MAJOR=`expr "${VERSION:0:1}" + 0`MINOR=`expr "${VERSION:1:2}" + 0`PATCH=`expr "${VERSION:3:2}" + 0`sed -Ei.bak -e "s/version [0-9]+\.[0-9]+\.[0-9]+/version $MAJOR.$MINOR.$PATCH/g" "$DOCS"sed -i.bak -e "/^SQLITE_/,\$d" "$DOCS"sed -i.bak -e "/^HAVE_/,\$d" "$DOCS"rm "$DOCS".bakprintf "$DEFINES" | sed -e "/^\s*$/d" >> "$DOCS"printf "\`\`\`\n" >> "$DOCS"echo "cleaning up..."cd - > /dev/null || exit 1rm -rf "$TEMP"echo "done!"" (Indicator: ""curl") in Source: download.sh, Observed string: "#!/usr/bin/env bash# ===# This script defines and generates the bundled SQLite unit (sqlite3.c).# The following steps are taken:# 1. populate the shell environment with the defined compile-time options.# 2. download and extract the SQLite source code into a temporary directory.# 3. run "sh configure" and "make sqlite3.c" within the source directory.# 4. copy the generated amalgamation into the output directory (./sqlite3).# 5. export the defined compile-time options to a gyp file (./defines.gypi).# 6. update the docs (../docs/compilation.md) with details of this distribution.# When a user builds better-sqlite3, the following steps are taken:# 1. node-gyp loads the previously exported compile-time options (defines.gypi).# 2. the copy.js script copies the bundled amalgamation into the build folder.# 3. node-gyp compiles the copied sqlite3.c along with better_sqlite3.cpp.# 4. node-gyp links the two resulting binaries to generate better_sqlite3.node.# ===YEAR="2026"VERSION="3510300"# Defines below are sorted alphabeticallyDEFINES="HAVE_INT16_T=1HAVE_INT32_T=1HAVE_INT8_T=1HAVE_STDINT_H=1HAVE_UINT16_T=1HAVE_UINT32_T=1HAVE_UINT8_T=1HAVE_USLEEP=1SQLITE_DEFAULT_CACHE_SIZE=-16000SQLITE_DEFAULT_FOREIGN_KEYS=1SQLITE_DEFAULT_MEMSTATUS=0SQLITE_DEFAULT_WAL_SYNCHRONOUS=1SQLITE_DQS=0SQLITE_ENABLE_COLUMN_METADATASQLITE_ENABLE_DBSTAT_VTABSQLITE_ENABLE_DESERIALIZESQLITE_ENABLE_FTS3SQLITE_ENABLE_FTS3_PARENTHESISSQLITE_ENABLE_FTS4SQLITE_ENABLE_FTS5SQLITE_ENABLE_GEOPOLYSQLITE_ENABLE_JSON1SQLITE_ENABLE_MATH_FUNCTIONSSQLITE_ENABLE_RTREESQLITE_ENABLE_STAT4SQLITE_ENABLE_UPDATE_DELETE_LIMITSQLITE_LIKE_DOESNT_MATCH_BLOBSSQLITE_OMIT_DEPRECATEDSQLITE_OMIT_PROGRESS_CALLBACKSQLITE_OMIT_SHARED_CACHESQLITE_OMIT_TCL_VARIABLESQLITE_SOUNDEXSQLITE_THREADSAFE=2SQLITE_TRACE_SIZE_LIMIT=32SQLITE_USE_URI=0# ========== START SCRIPT ========== #echo "setting up environment..."DEPS="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"TEMP="$DEPS/temp"OUTPUT="$DEPS/sqlite3"rm -rf "$TEMP"rm -rf "$OUTPUT"mkdir -p "$TEMP"mkdir -p "$OUTPUT"export CFLAGS=`echo $(echo "$DEFINES" | sed -e "/^\s*$/d" -e "s/^/-D/")`echo "downloading source..."curl -#f "https://www.sqlite.org/$YEAR/sqlite-src-$VERSION.zip" > "$TEMP/source.zip" || exit 1echo "extracting source..."unzip "$TEMP/source.zip" -d "$TEMP" > /dev/null || exit 1cd "$TEMP/sqlite-src-$VERSION" || exit 1echo "configuring amalgamation..."sh configure > /dev/null || exit 1echo "building amalgamation..."make OPTIONS="$CFLAGS" sqlite3.c > /dev/null || exit 1echo "copying amalgamation..."cp sqlite3.c sqlite3.h sqlite3ext.h "$OUTPUT/" || exit 1echo "applying patches..."cd "$DEPS" || exit 1for patch in patches/*.patch; do # If a patch fails, just skip it an move on. # By default `patch` tries to be clever and reverse the patch, so we have to specify `--forward`. # If the patch fails, we # don't write .orig and .rej files so we have to specify `--no-backup-if-mismatch` and `--reject-file=-`. patch --batch --forward --no-backup-if-mismatch --reject-file=- -p2 < "$patch"doneecho "updating gyp configs..."GYP="$DEPS/defines.gypi"printf "# THIS FILE IS AUTOMATICALLY GENERATED BY deps/download.sh (DO NOT EDIT)\n\n{\n 'defines': [\n" > "$GYP"printf "$DEFINES" | sed -e "/^\s*$/d" -e "s/$.*$/ '\1',/" >> "$GYP"printf " ],\n}\n" >> "$GYP"echo "updating docs..."DOCS="$DEPS/../docs/compilation.md"MAJOR=`expr "${VERSION:0:1}" + 0`MINOR=`expr "${VERSION:1:2}" + 0`PATCH=`expr "${VERSION:3:2}" + 0`sed -Ei.bak -e "s/version [0-9]+\.[0-9]+\.[0-9]+/version $MAJOR.$MINOR.$PATCH/g" "$DOCS"sed -i.bak -e "/^SQLITE_/,\$d" "$DOCS"sed -i.bak -e "/^HAVE_/,\$d" "$DOCS"rm "$DOCS".bakprintf "$DEFINES" | sed -e "/^\s*$/d" >> "$DOCS"printf "\`\`\`\n" >> "$DOCS"echo "cleaning up..."cd - > /dev/null || exit 1rm -rf "$TEMP"echo "done!"" (Indicator: "curl -") in Source: download.sh55:T691,file/memory contains long string with (Indicator: " connect "; File: "alpc.py") file/memory contains long string with (Indicator: " shutdown "; File: "registry.py") file/memory contains long string with (Indicator: " bind "; File: "client.py") file/memory contains long string with (Indicator: " socket "; File: "network.py") file/memory contains long string with (Indicator: "inet_ntoa"; File: "network.py") file/memory contains long string with (Indicator: " connect "; File: "epmapper.py") file/memory contains long string with (Indicator: " connect "; File: "pipe.py") file/memory contains long string with (Indicator: " socket "; File: "__init__.py") file/memory contains long string with (Indicator: "wsastartup"; File: "ws2_32.py") file/memory contains long string with (Indicator: "wsacleanup"; File: "ws2_32.py") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "ws2_32.py") file/memory contains long string with (Indicator: " shutdown "; File: "native_function.py") Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00007016-00000C2C-2032039726") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp")56:T490,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" "2.5.29.17" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.32" "2.5.29.14" "2.5.29.15" "2.5.29.19" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.4.7" "2.5.4.11" "2.5.4.5" "2.5.4.10" "2.5.4.8" "2.5.29.1" "2.5.4.6" "2.5.4.3" "2.5.29.10" "2.5.29.16" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure.CimCmdlets.resources,1.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Utility.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "=1.0.0.0, Cu8" "127.0.0.1"57:T37ba,Heuristic match: "e+.pk" Heuristic match: "m%.gq" Heuristic match: "c~.fk" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info" Pattern match: "https://docs.microsoft.com/en-us/windows/desktop/secauthz/access-tokensclass" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______" Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=winvernotes" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380264(v=vs.85).aspx" Pattern match: "https://documentation-service.arm.com/static/67581b3355451e3c38d97c22#" Pattern match: "https://docs.python.org/3/c-api/init.html#c.pyeval_initthreads" Pattern match: "https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupdigetdeviceregistrypropertya#spdrp_address" Pattern match: "https://docs.microsoft.com/en-us/windows/desktop/api/wbemcli/nn-wbemcli-iwbemclassobjectwmimethod" Pattern match: "http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm#tagcjh_19_03_07##" Pattern match: "https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-address-table" Pattern match: "https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties" Pattern match: "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/main/ntcorelib/win32/rpc/transport/alpc/lrpc_immediate_response_message.cs#l22class" Pattern match: "https://github.com/hakril/pythonforwindows/issues/10" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/desktop/aa362823(v=vs.85).aspx" Pattern match: "http://pubs.opengroup.org/onlinepubs/9629399/apdxi.htm#tagcjh_28#" Pattern match: "https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/desktop/aa380252(v=vs.85).aspx#low_level_message_functions" Pattern match: "https://www.sqlite.org/$year/sqlite-src-$version.zip" Pattern match: "https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-querydosdevicea" Pattern match: "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376039(v=vs.85).aspx" Pattern match: "https://docs.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptprotectdata" Pattern match: "https://learn.microsoft.com/en-us/windows/win32/hyperv_v2/msvm-computersystem" Pattern match: "https://docs.microsoft.com/en-us/windows/desktop/api/shlwapi/nf-shlwapi-isos#remarks" Pattern match: "https://docs.microsoft.com/en-us/windows/desktop/etw/retrieving-event-data-using-tdhclass" Heuristic match: "pypi.org" Heuristic match: "files.pythonhosted.org" Heuristic match: "api.gofile.io" Heuristic match: "bootstrap.pypa.io" Heuristic match: "flagbrother.uk" Pattern match: "www.myexternalip.com" Pattern match: "www.python.org" Heuristic match: "%temp%\nsoe891.tmp\7z-out\resources\app.asar.unpacked\node_modules\@img\colour\license.md" Heuristic match: "%temp%\nsoe891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/generated_def\__pycache__\windef.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/native_exec\__pycache__\__init__.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\dnsapi.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\ktmw32.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\ncrypt.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\oleacc.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\user32.cpython-311.py" Heuristic match: "%localappdata%\programs\python\python311\lib\site-packages\windows/winproxy/apis\__pycache__\ws2_32.cpython-311.py" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.mp" Heuristic match: "6299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "stem.management.automation.re" Heuristic match: "ystem.management.automation.re" Heuristic match: "on.re" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "t.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ement.au" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "d64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/microsoft.management.infrastructure.native/v4.0_1.0.0.0__31bf3856ad364e35/microsoft.management.infrastructure.native.dll" Heuristic match: "micrlistt.co" Heuristic match: "15.cat" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://anglebug.com/40096838" Pattern match: "http://anglebug.com/41488637" Pattern match: "http://anglebug.com/42264193" Pattern match: "http://anglebug.com/1423136" Pattern match: "http://anglebug.com/42265509" Pattern match: "https://anglebug.com/42265720" Pattern match: "http://anglebug.com/42264287" Pattern match: "http://anglebug.com/42266194" Pattern match: "http://anglebug.com/40644912" Pattern match: "http://anglebug.com/40644627" Pattern match: "http://anglebug.com/42263580" Pattern match: "http://anglebug.com/42266231" Pattern match: "http://anglebug.com/355645824" Pattern match: "http://anglebug.com/42266842" Pattern match: "http://anglebug.com/42266232" Pattern match: "https://crbug.com/650547" Pattern match: "http://anglebug.com/40096371" Pattern match: "https://crbug.com/655534" Pattern match: "http://crbug.com/350528343" Pattern match: "http://anglebug.com/42264571" Pattern match: "http://anglebug.com/40096608" Pattern match: "https://crbug.com/593024" Pattern match: "http://anglebug.com/42261924" Pattern match: "http://crbug.com/941620" Pattern match: "https://issuetracker.google.com/349489248" Pattern match: "https://issuetracker.google.com/292285899" Pattern match: "https://issuetracker.google.com/220069903" Pattern match: "https://nodejs.org/download/release/v20.18.0/node-v20.18.0.tar.gz" Pattern match: "https://nodejs.org/download/release/v20.18.0/node-v20.18.0-headers.tar.gz" Heuristic match: "blink.net" Heuristic match: "xe;.ba" Pattern match: "https://www.khronos.org/spir/visualizer/" Heuristic match: "l,)t.ps" Heuristic match: "" (Indicator: "password"; Source: "00000000-00000260.00000001.195119.AEA50000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000260.00000001.195119.AEA50000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00002516.00000000.196177.00124000.00000004.mdmp, 00000000-00002516.00000001.198098.000D4000.00000004.mdmp, 00000000-00002516.00000002.200018.000D4000.00000004.mdmp")61:Td77,Found string "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007016-00000C47-13769322540") Found string "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00007016-00000C47-13769322540") Found string "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007180-00000C47-1559224752") Found string "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00007180-00000C47-1559224752") Found string "(Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystem"; File: "AMSI") Found string "(Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystemProduct"; File: "AMSI") Found string "/d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""" (Indicator: " Win32_ComputerSystem"; File: "cmd.exe") Found string "/d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""" (Indicator: " Win32_ComputerSystemProduct"; File: "cmd.exe") Found string "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp") Found string "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp") Found string "(Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000000.194951.92E70000.00000004.mdmp, 00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92E70000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AEA50000.00000004.mdmp") Found string "(Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000000.194951.92E70000.00000004.mdmp, 00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92E70000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AEA50000.00000004.mdmp") Found string "HostApplication=powershell -Command (Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp") Found string "HostApplication=powershell -Command (Get-CimInstance Win32_ComputerSystemProduct).UUID" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp")62:T407,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000260.00000000.194951.92B50000.00000004.mdmp, 00000000-00000260.00000001.195119.92B50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\3CDog4NaSAHpPeWyqcXIvnctUk8\Application.exe" (Indicator: "\Device\"; Source: "00000000-00002516.00000000.196177.07820000.00000004.mdmp, 00000000-00002516.00000001.198098.07820000.00000004.mdmp, 00000000-00002516.00000002.200018.07820000.00000004.mdmp")63:T100e,"Application.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E9D2079559CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5E2780D959CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A7FAF4D959CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B3B975DA59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "806402DB59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "09B3B6DC59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F3636DDE59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "385784DF59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "4014A0E859CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "227486EA59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "ABA298EB59CDDC010000000000000000000000000200000000") "Application.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "808207F059CDDC010000000000000000000000000200000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0014D8DC59CDDC010000000000000000000000000200000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B364CAE659CDDC010000000000000000000000000200000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7CB2FAF059CDDC010000000000000000000000000200000000")64:T97d," HTTP/1.1 200 OK Connection: keep-alive Content-Length: 1664 access-control-expose-headers: X-PyPI-Last-Serial content-encoding: gzip referrer-policy: origin-when-cross-origin cache-control: max-age=600 public content-security-policy: default-src 'none'; sandbox allow-top-navigation access-control-allow-headers: Content-Type If-Match If-Modified-Since If-None-Match If-Unmodified-Since etag: "XhAXBKmnSQKOdWoO63mmRw" access-control-max-age: 86400 access-control-allow-methods: GET x-pypi-last-serial: 30691118 access-control-allow-origin: * Accept-Ranges: bytes Date: Wed 15 Apr 2026 21:30:50 GMT X-Served-By: cache-iad-kjyo7100057-IAD cache-iad-kjyo7100057-IAD cache-lax-kwhp1940025-LAX X-Cache: MISS HIT HIT X-Cache-Hits: 0 1130 0 X-Timer: S1776288651.753163 VS0 VE63 Content-Type: application/vnd.pypi.simple.v1+json Vary: Accept Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Permissions-Policy: publickey-credentials-create=(self) publickey-credentials-get=(self) accelerometer=() ambient-light-sensor=() autoplay=() battery=() camera=() display-capture=() document-domain=() encrypted-media=() execution-while-not-rendered=() execution-while-out-of-viewport=() fullscreen=() gamepad=() geolocation=() gyroscope=() hid=() identity-credentials-get=() idle-detection=() local-fonts=() magnetometer=() microphone=() midi=() otp-credentials=() payment=() picture-in-picture=() screen-wake-lock=() serial=() speaker-selection=() storage-access=() usb=() web-share=() xr-spatial-tracking=() with response body ==>7B22616C7465726E6174652D6C6F636174696F6E73223A5B5D2C2266696C6573223A5B7B22636F72652D6D65746164617461223A7B22736861323536223A2265....... "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl.metadata HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.0 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.0"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 23424 Server: nginx Content-Type: application/octet-stream Last-Modified: Thu 14 Aug 2025 09:14:43 GMT ETag: "5447a904f61121430e6f3a61125c4eff" x-amz-request-id: 7b1c169d0f8d60c0 x-amz-id-2: aN1ZjeDFvNjtmwDHBME1kJWY/Y+gw7TjO x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f1036e39c805e682b_d20250814_m091443_c005_v0501027_t0003_u01755162883680 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 447287 Date: Wed 15 Apr 2026 21:30:50 GMT X-Served-By: cache-iad-kiad7000177-IAD cache-lax-kwhp1940068-LAX X-Cache: HIT HIT X-Cache-Hits: 67 0 X-Timer: S1776288651.906346 VS0 VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 1.0.4 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pythonforwindows with response body ==>4D657461646174612D56657273696F6E3A20322E340D0A4E616D653A20507974686F6E466F7257696E646F77730D0A56657273696F6E3A20312E302E340D0A53....... "GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1 Host: files.pythonhosted.org User-Agent: pip/26.0 {"ci":null,"cpu":"AMD64","implementation":{"name":"CPython","version":"3.11.0"},"installer":{"name":"pip","version":"26.0"},"openssl_version":"OpenSSL 1.1.1q 5 Jul 2022","python":"3.11.0","setuptools_version":"80.10.2","system":{"name":"Windows","release":"10"}} Accept-Encoding: identity Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 750759 Server: nginx Content-Type: application/octet-stream Last-Modified: Thu 14 Aug 2025 09:14:43 GMT ETag: "4dda2c3a725241273f8bfca5e9be8334" x-amz-request-id: c9dd440865ebb043 x-amz-id-2: aN41jQTEBNhpmGDGjMD9kZWbUYw4w8Tgm x-amz-version-id: 4_z179c51e67f11a0ad8f6c0018_f1036e39c805e681f_d20250814_m091443_c005_v0501027_t0056_u01755162883392 Cache-Control: max-age=365000000 immutable public Accept-Ranges: bytes Age: 569764 Date: Wed 15 Apr 2026 21:30:51 GMT X-Served-By: cache-iad-kcgs7200038-IAD cache-lax-kwhp1940068-LAX X-Cache: HIT MISS X-Cache-Hits: 162 0 X-Timer: S1776288651.957448 VS0 VE76 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Robots-Header: noindex Access-Control-Allow-Methods: GET OPTIONS Access-Control-Allow-Headers: Range Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Range Accept-Ranges x-pypi-file-python-version: py3 x-pypi-file-version: 1.0.4 x-pypi-file-package-type: bdist_wheel x-pypi-file-project: pythonforwindows with response body ==>504B0304140000000800C298480E5B367F19C38E0A0000000800000031000000707974686F6E666F7277696E646F77732D312E302E342E646973742D696E666F.......6c:T6599,"libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\libGLESv2.dll]- [targetUID: 00000000-00002516] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00002516] "Application.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 15 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\Application.exe]- [targetUID: 00000000-00002516] "libvips-42.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\libvips-42.dll]- [targetUID: 00000000-00006256] "MicrosoftUpdate.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Fonts\MicrosoftUpdate.exe]- [targetUID: 00000000-00007016] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\ffmpeg.dll]- [targetUID: 00000000-00002516] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00006256] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\libEGL.dll]- [targetUID: 00000000-00002516] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsoE891.tmp\nsis7z.dll]- [targetUID: 00000000-00006256] "libvips-cpp-8.17.3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\libvips-cpp-8.17.3.dll]- [targetUID: 00000000-00006256] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00006256] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsoE891.tmp\StdUtils.dll]- [targetUID: 00000000-00006256] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsoE891.tmp\System.dll]- [targetUID: 00000000-00000260] "better_sqlite3.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node]- [targetUID: 00000000-00006256] "node-screenshots.win32-x64-msvc.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-screenshots-win32-x64-msvc\node-screenshots.win32-x64-msvc.node]- [targetUID: 00000000-00006256] "winerror.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winerror.py]- [targetUID: 00000000-00008068] "winstructs.py" has type "Python script ASCII text executable with very long lines (1537) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winstructs.py]- [targetUID: 00000000-00008068] "sharp-win32-x64.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\@img\sharp-win32-x64\lib\sharp-win32-x64.node]- [targetUID: 00000000-00006256] "ntstatus.py" has type "Python script ASCII text executable with very long lines (449) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\ntstatus.py]- [targetUID: 00000000-00008068] "winfuncs.py" has type "Python script ASCII text executable with very long lines (313) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\winfuncs.py]- [targetUID: 00000000-00008068] "windef.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\windef.py]- [targetUID: 00000000-00008068] "vmdetector.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3CDog4NaSAHpPeWyqcXIvnctUk8\resources\app.asar.unpacked\node_modules\vmdetector\build\Release\vmdetector.node]- [targetUID: 00000000-00006256] "interfaces.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\interfaces.py]- [targetUID: 00000000-00008068] "dpapi.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\build\Release\dpapi.node]- [targetUID: 00000000-00007016] "process.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\process.py]- [targetUID: 00000000-00008068] "debugger.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\debugger.py]- [targetUID: 00000000-00008068] "simple_x64.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_x64.py]- [targetUID: 00000000-00008068] "kernel32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\kernel32.py]- [targetUID: 00000000-00008068] "event_log.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\event_log.py]- [targetUID: 00000000-00008068] "simple_x86.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_x86.py]- [targetUID: 00000000-00008068] "advapi32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\advapi32.py]- [targetUID: 00000000-00008068] "security.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\security.py]- [targetUID: 00000000-00008068] "symbols.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\symbols.py]- [targetUID: 00000000-00008068] "token.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\token.py]- [targetUID: 00000000-00008068] "winutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\winutils.py]- [targetUID: 00000000-00008068] "system.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\system.py]- [targetUID: 00000000-00008068] "alpc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\alpc.py]- [targetUID: 00000000-00008068] "certificate.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\certificate.py]- [targetUID: 00000000-00008068] "simple_arm64.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\simple_arm64.py]- [targetUID: 00000000-00008068] "ntdll.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ntdll.py]- [targetUID: 00000000-00008068] "injection.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\injection.py]- [targetUID: 00000000-00008068] "device_manager.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\device_manager.py]- [targetUID: 00000000-00008068] "wmi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\wmi.py]- [targetUID: 00000000-00008068] "registry.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\registry.py]- [targetUID: 00000000-00008068] "ndr.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\ndr.py]- [targetUID: 00000000-00008068] "pe_parse.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\pe_parse.py]- [targetUID: 00000000-00008068] "remotectypes.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\remotectypes.py]- [targetUID: 00000000-00008068] "event_trace.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\event_trace.py]- [targetUID: 00000000-00008068] "client.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\client.py]- [targetUID: 00000000-00008068] "syswow64.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\syswow64.py]- [targetUID: 00000000-00008068] "com.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\com.py]- [targetUID: 00000000-00008068] "crypt32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\crypt32.py]- [targetUID: 00000000-00008068] "network.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\network.py]- [targetUID: 00000000-00008068] "localdbg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\localdbg.py]- [targetUID: 00000000-00008068] "nativeutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\nativeutils.py]- [targetUID: 00000000-00008068] "exception.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\exception.py]- [targetUID: 00000000-00008068] "breakpoints.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\breakpoints.py]- [targetUID: 00000000-00008068] "dbghelp.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\dbghelp.py]- [targetUID: 00000000-00008068] "service.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\service.py]- [targetUID: 00000000-00008068] "object_manager.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\object_manager.py]- [targetUID: 00000000-00008068] "bits.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\bits.py]- [targetUID: 00000000-00008068] "handle.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\handle.py]- [targetUID: 00000000-00008068] "epmapper.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\epmapper.py]- [targetUID: 00000000-00008068] "wintrust.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\wintrust.py]- [targetUID: 00000000-00008068] "apisetmap.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\apisetmap.py]- [targetUID: 00000000-00008068] "wevtapi.py" has type "Python script ASCII text executable with CRLF line terminators"- [targetUID: 00000000-00008068] "cpuid.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\cpuid.py]- [targetUID: 00000000-00008068] "cryptmsg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\cryptmsg.py]- [targetUID: 00000000-00008068] "wininet.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\wininet.py]- [targetUID: 00000000-00008068] "encrypt_decrypt.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\encrypt_decrypt.py]- [targetUID: 00000000-00008068] "apiproxy.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apiproxy.py]- [targetUID: 00000000-00008068] "hooks.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\hooks.py]- [targetUID: 00000000-00008068] "improved_buffer.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\improved_buffer.py]- [targetUID: 00000000-00008068] "cfgmgr32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\cfgmgr32.py]- [targetUID: 00000000-00008068] "pipe.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\pipe.py]- [targetUID: 00000000-00008068] "pythonutils.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\pythonutils.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\__init__.py]- [targetUID: 00000000-00008068] "download.sh" has type "Bourne-Again shell script ASCII text executable"- Location: [%TEMP%\nsoE891.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh]- [targetUID: 00000000-00006256] "user32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\user32.py]- [targetUID: 00000000-00008068] "volume.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\volume.py]- [targetUID: 00000000-00008068] "setupapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\setupapi.py]- [targetUID: 00000000-00008068] "netapi32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\netapi32.py]- [targetUID: 00000000-00008068] "sign_verify.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\sign_verify.py]- [targetUID: 00000000-00008068] "ws2_32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ws2_32.py]- [targetUID: 00000000-00008068] "native_function.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\native_function.py]- [targetUID: 00000000-00008068] "wintrust.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\wintrust.py]- [targetUID: 00000000-00008068] "ole32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ole32.py]- [targetUID: 00000000-00008068] "error.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\error.py]- [targetUID: 00000000-00008068] "file.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\file.py]- [targetUID: 00000000-00008068] "version.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\version.py]- [targetUID: 00000000-00008068] "generation.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\generation.py]- [targetUID: 00000000-00008068] "winhttp.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\winhttp.py]- [targetUID: 00000000-00008068] "symboldbg.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\symboldbg.py]- [targetUID: 00000000-00008068] "psapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\psapi.py]- [targetUID: 00000000-00008068] "flag.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\generated_def\flag.py]- [targetUID: 00000000-00008068] "iphlpapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\iphlpapi.py]- [targetUID: 00000000-00008068] "dpapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\dpapi.py]- [targetUID: 00000000-00008068] "test.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\test.py]- [targetUID: 00000000-00008068] "hyperv.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winobject\hyperv.py]- [targetUID: 00000000-00008068] "oleaut32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\oleaut32.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\__init__.py]- [targetUID: 00000000-00008068] "dnsapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\dnsapi.py]- [targetUID: 00000000-00008068] "shell32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\shell32.py]- [targetUID: 00000000-00008068] "ktmw32.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ktmw32.py]- [targetUID: 00000000-00008068] "shlwapi.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\shlwapi.py]- [targetUID: 00000000-00008068] "virtdisk.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\virtdisk.py]- [targetUID: 00000000-00008068] "ncrypt.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\ncrypt.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\__init__.py]- [targetUID: 00000000-00008068] "tdh.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\tdh.py]- [targetUID: 00000000-00008068] "cryptui.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\cryptui.py]- [targetUID: 00000000-00008068] "oleacc.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\apis\oleacc.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\debug\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\winproxy\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\rpc\__init__.py]- [targetUID: 00000000-00008068] "catalog.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\crypto\catalog.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\utils\__init__.py]- [targetUID: 00000000-00008068] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\windows\native_exec\__init__.py]- [targetUID: 00000000-00008068]6d:Td60,"Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\LIGHTCORD\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GUEST PROFILE\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GUEST PROFILE\NETWORK\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\PROFILE 1\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\PROFILE 2\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\PROFILE 3\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\PROFILE 4\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\PROFILE 5\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\GUEST PROFILE\LOCAL STORAGE\LEVELDB" "Application.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\PROFILE 1\LOCAL STORAGE\LEVELDB"6e:T5b1," "%TEMP%\\mswu_07055475.txt"" (UID: 00000000-00006420) Spawned process "python.exe" with commandline "-c "import sys;print(sys.executable)"" (UID: 00000000-00006336) Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003580) Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" -c "import Crypto,windows""" (UID: 00000000-00004748) Spawned process "python.exe" with commandline "-c "import Crypto windows"" (UID: 00000000-00004272) Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" -m pip install --quiet --no-cache-dir pycryptodome PythonForWindows"" (UID: 00000000-00003980) Spawned process "python.exe" with commandline "-m pip install --quiet --no-cache-dir pycryptodome PythonForWindows" (UID: 00000000-00008068) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00002792) Spawned process "cmd.exe" with commandline "/c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\\mswu_0533424.txt"" (UID: 00000000-00006036) Spawned process "schtasks.exe" with commandline "schtasks /query /tn "MicrosoftUpdateService_sys"" (UID: 00000000-00003708) Spawned process "cmd.exe" with commandline "/d /s /c ""%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe" -c "import Crypto,windows""" (UID: 00000000-00006296) Spawned process "python.exe" with commandline "-c "import Crypto windows"" (UID: 00000000-00001244) Spawned process "cmd.exe" with commandline "/d /s /c "python --version"" (UID: 00000000-00000620) Spawned process "python.exe" with commandline "python --version" (UID: 00000000-00001420) Spawned process "cmd.exe" with commandline "/d /s /c "python -m pip install --quiet --no-cache-dir pythonforwindows pycryptodome"" (UID: 00000000-00003736) Spawned process "python.exe" with commandline "python -m pip install --quiet --no-cache-dir pythonforwindows pycryptodome" (UID: 00000000-00005676) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00001752) Spawned process "cmd.exe" with commandline "/d /s /c "python "%TEMP%\\grrpaw.py""" (UID: 00000000-00006232) Spawned process "python.exe" with commandline "python "%TEMP%\\grrpaw.py"" (UID: 00000000-00004788) Spawned process "cmd.exe" with commandline "/c schtasks /query /tn "MicrosoftUpdateService_sys" > "%TEMP%\\mswu_05795186.txt"" (UID: 00000000-00005164)72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ACZmZmZmZmZmZmZmZmZmZkJmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZiIiImZmZmZmZmZmZmZmZj/////iZmZmZmZmZmZmZj///////+JmZmZmZmZmZmP////////+JmZmZmZmZmY//////////iZmZmZmZmZn///+Id4j/+JmZmZmZmZmY///4mZmZiImZmZmZmZmZn///iZmZmZmZmZmZmZmZmY//+JmZmZmZmZmZmZmZmZmP//iZmZmZmZmZmZmZmZmZj//3mZmZmZmZmZmZmZmZmY//95mZmZmZmZmZmZmZmZmP//iZmZmZmZmZmZmZmZmZf//4mZmZmZmZmZmZmZmZmZ///4mZmZmZmZmZmZmZmZmY///4mZmZiImZmZmZmZmZmf///4iIiP/4mZmZmZmZmZmP/////////4mZmZmZmZmZmP////////+JmZmZmZmZmZmI//////+ImZmZmZmZmZmZmYj///+ImZmZmZmZmZmZmZmZeIiHmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmQmZmZmZmZmZmZmZmZmZmZAoAAAAGAAAADAAAAABACAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8A/w4yAP9fNgD/xjYA//Y3AP//NwD//zcA//83AP//NwD//zcA//83AP//NwD//zcA//83AP//NwD//zcA//83AP//NwD//zYA//g2AP/NMwD/aQ==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791202782412,"unified_at":"2026-10-05T12:19:42.412Z","metadata":{"hashes":{"sha256":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65","sha1":"6a23cbb7c03d4c0ef08707e25beb6e63e58f0e11","md5":"b707f4b73d9595a4ac8b484f5560f377","sha512":"23f5f1679a3eb120685ffe1d33389fa137e001c75166e214c1d1ff1bd957d39adcb837258284965471ee0683f0fa2c23500f1c5a763afb9f335843d86539b11f","ssdeep":"1572864:stLozwYRG9l54/PA5h/sI3z2YVaevJkeGxyGGNyGQ9ZPOjOyyIHjZ7d+T7:sZo8plGA5h0I3z2eaevJqG4ByyIHjZkP","ssdeep_chunks":["1572864:stLozwY","1572864:tLozwYR","1572864:LozwYRG","1572864:ozwYRG9","1572864:zwYRG9l","1572864:wYRG9l5","1572864:YRG9l54","1572864:RG9l54/","1572864:G9l54/P","1572864:9l54/PA","1572864:l54/PA5","1572864:54/PA5h","1572864:4/PA5h/","1572864:/PA5h/s","1572864:PA5h/sI","1572864:A5h/sI3","1572864:5h/sI3z","1572864:h/sI3z2","1572864:/sI3z2Y","1572864:sI3z2YV","1572864:I3z2YVa","1572864:3z2YVae","1572864:z2YVaev","1572864:2YVaevJ","1572864:YVaevJk","1572864:VaevJke","1572864:aevJkeG","1572864:evJkeGx","1572864:vJkeGxy","1572864:JkeGxyG","1572864:keGxyGG","1572864:eGxyGGN","1572864:GxyGGNy","1572864:xyGGNyG","1572864:yGGNyGQ","1572864:GGNyGQ9","1572864:GNyGQ9Z","1572864:NyGQ9ZP","1572864:yGQ9ZPO","1572864:GQ9ZPOj","1572864:Q9ZPOjO","1572864:9ZPOjOy","1572864:ZPOjOyy","1572864:POjOyyI","1572864:OjOyyIH","1572864:jOyyIHj","1572864:OyyIHjZ","1572864:yyIHjZ7","1572864:yIHjZ7d","1572864:IHjZ7d+","1572864:HjZ7d+T","1572864:jZ7d+T7","3145728:stLozwY","3145728:tLozwYR","3145728:LozwYRG","3145728:ozwYRG9","3145728:zwYRG9l","3145728:wYRG9l5","3145728:YRG9l54","3145728:RG9l54/","3145728:G9l54/P","3145728:9l54/PA","3145728:l54/PA5","3145728:54/PA5h","3145728:4/PA5h/","3145728:/PA5h/s","3145728:PA5h/sI","3145728:A5h/sI3","3145728:5h/sI3z","3145728:h/sI3z2","3145728:/sI3z2Y","3145728:sI3z2YV","3145728:I3z2YVa","3145728:3z2YVae","3145728:z2YVaev","3145728:2YVaevJ","3145728:YVaevJk","3145728:VaevJke","3145728:aevJkeG","3145728:evJkeGx","3145728:vJkeGxy","3145728:JkeGxyG","3145728:keGxyGG","3145728:eGxyGGN","3145728:GxyGGNy","3145728:xyGGNyG","3145728:yGGNyGQ","3145728:GGNyGQ9","3145728:GNyGQ9Z","3145728:NyGQ9ZP","3145728:yGQ9ZPO","3145728:GQ9ZPOj","3145728:Q9ZPOjO","3145728:9ZPOjOy","3145728:ZPOjOyy","3145728:POjOyyI","3145728:OjOyyIH","3145728:jOyyIHj","3145728:OyyIHjZ","3145728:yyIHjZ7","3145728:yIHjZ7d","3145728:IHjZ7d+","3145728:HjZ7d+T","3145728:jZ7d+T7","1572864:sZo8plG","1572864:Zo8plGA","1572864:o8plGA5","1572864:8plGA5h","1572864:plGA5h0","1572864:lGA5h0I","1572864:GA5h0I3","1572864:A5h0I3z","1572864:5h0I3z2","1572864:h0I3z2e","1572864:0I3z2ea","1572864:I3z2eae","1572864:3z2eaev","1572864:z2eaevJ","1572864:2eaevJq","1572864:eaevJqG","1572864:aevJqG4","1572864:evJqG4B","1572864:vJqG4By","1572864:JqG4Byy","1572864:qG4ByyI","1572864:G4ByyIH","1572864:4ByyIHj","1572864:ByyIHjZ","1572864:yyIHjZk","1572864:yIHjZkP"],"imphash":"Unknown"},"file_info":{"file_name":"Application.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":84521014,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776288469000,"last_seen":1776288469000,"last_multi_scan":1776288469000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","deploymentframework","modular","metasploit","rat","backdoor","opensource","redlinestealer","informationstealer","exploit","new_domain","malicious","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":109},"sandbox_signatures":{"informative_count":241,"suspicious_count":28,"malicious_count":8,"total":277},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains reference to WMI activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"Executes a Python script"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"References to WMI query strings used for identifying physical or virtual machine environment"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","identifiers":[{"type":"suspicious","value":"Tries to open private key files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Tries to query scheduled tasks"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Retrieves instances of WMI objects using PowerShell"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"},{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped a large number of files"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netgroupenum\"; File: \"netapi32.py\")\n file/memory contains long string with (Indicator: \"netgroupgetinfo\"; File: \"netapi32.py\")\n file/memory contains long string with (Indicator: \"netgroupgetusers\"; File: \"netapi32.py\")\n file/memory contains long string with (Indicator: \"netlocalgroupenum\"; File: \"netapi32.py\")\n file/memory contains long string with (Indicator: \"netlocalgroupgetinfo\"; File: \"netapi32.py\")\n file/memory contains long string with (Indicator: \"netlocalgroupgetmembers\"; File: \"netapi32.py\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"System.dll\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"vkFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002516.00000000.196177.0DC20000.00000004.mdmp, 00000000-00002516.00000000.196177.E394B000.00000002.mdmp, 00000000-00002516.00000001.198098.0DC20000.00000004.mdmp, 00000000-00002516.00000001.198098.E4D4F000.00000002.mdmp, 00000000-00002516.00000002.200018.0DC20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00000260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00000260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00000260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00000260)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1617400430593', 'hResInfo': '1617400431840'}\" (UID: 00000000-00000260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1617400430593', 'hResInfo': '1617400431872'}\" (UID: 00000000-00000260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1617400430593', 'hResInfo': '1617400431888'}\" (UID: 00000000-00000260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1617400430593', 'hResInfo': '1617400431856'}\" (UID: 00000000-00000260)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$27","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"sign_verify.py\")\n file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"wintrust.py\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00000260-00000BC0-2039067246\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000260.00000000.194951.AD030000.00000004.mdmp, 00000000-00000260.00000001.195119.AD030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Application.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 016B0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\" \"%TEMP%\\mswu_07055475.txt\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006492-00002718-2095625561\")\n Found string \"cmd.exe /c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_0533424.txt\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006492-00002718-2112668955\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00008068-00000C47-12552124540\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00008068-00000C47-12552124540\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp, 00000000-00000260.00000001.195119.F32B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains reference to WMI activity (Powershell command string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-390","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\")\n file/memory contains long string with (Indicator: \"SHFileOperation\"; File: \"shell32.py\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3f","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"(Get-CimInstance Win32_ComputerSystemProduct).UUID\"\" (UID: 00000000-00000260)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Executes a Python script","description":"Process \"python.exe\" with commandline python \"%TEMP%\\\\grrpaw.py\" (UID: 00000000-00004788)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":1,"id":"target-318","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$41","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.7016.4448.17914536889060839646\n Found string - \\\\.\\pipe\\mojo.7016.4448.14796146711722989850\n Found string - \\\\.\\pipe\\PSHost.134207873557720698.260.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E1A50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F32C0000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F71F0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000260.00000001.195119.AEA50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumValueW\" in file \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\"\n Found registry query API: \"RegEnumKeyW\" in file \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\"\n Found registry query API: \"RegQueryValueExW\" in file \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\"\n Found registry query API: \"RegOpenKeyExW\" in file \"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000260.00000001.195119.14CCA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve credentials from memory","description":"file/memory contains long string with (Indicator: \" securityd\"; File: \"device_manager.py\")\n file/memory contains long string with (Indicator: \" securityd\"; File: \"registry.py\")\n file/memory contains long string with (Indicator: \" securityd\"; File: \"virtdisk.py\")","origin":"File/Memory","mitre_attack_id":"T1555.002","relevance":1,"id":"string-5073","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"(Get-CimInstance Win32_ComputerSystemProduct).UUID\"\" (UID: 00000000-00000260)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\" \"%TEMP%\\\\mswu_07055475.txt\"\" (UID: 00000000-00006420)\n Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\\\mswu_0533424.txt\"\" (UID: 00000000-00006036)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/d /s /c \"python \"%TEMP%\\\\grrpaw.py\"\"\" (UID: 00000000-00006232)\n Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\\\mswu_05795186.txt\"\" (UID: 00000000-00005164)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to open private key files (file access)","description":"\"python.exe\" read a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Python\\Python311\\Lib\\site-packages\\pip\\_vendor\\certifi\\cacert.pem\"","origin":"API Call","mitre_attack_id":"T1552.004","relevance":3,"id":"api-137","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\" \"%TEMP%\\mswu_0705\" - (UID: 00000000-00006492), \"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_0533\" - (UID: 00000000-00006492)\n \"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_0579\" - (UID: 00000000-00006492)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 058B0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MicrosoftUpdateService_sys\" /tr \"\\\\\"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Fonts\\\\MicrosoftUpdate.exe\\\\\"\" /sc onlogon /rl highest /f\" (UID: 00000000-00007856)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Application.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe\" (Handle: 2200)\n \"Application.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe\" (Handle: 2200)\n \"Application.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe\" (Handle: 2244)\n \"Application.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe\" (Handle: 2244)\n \"Application.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 2312)\n \"Application.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 2312)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"flagbrother.uk\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$70","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$71","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}]},"activity":{"stats":{"process_count":37,"spawned_processes_count":37,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":47,"imported_dlls_count":171,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":173,"files_deleted_count":0,"registry_keys_created_count":27,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":27,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":7,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["commodity","deploymentframework","modular","metasploit","rat","backdoor","opensource","redlinestealer","informationstealer","exploit","new_domain","malicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69e002deeb2fd22c43031070","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["POL","USA"],"submit_name":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin","analysis_start_time":"2026-04-15T21:28:09+00:00","indicators_count":{"informative":241,"suspicious":74,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.138.16.202","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"address":"151.101.128.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"address":"167.82.48.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"address":"151.101.0.175","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"address":"34.160.111.145","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"address":"160.202.167.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"dns_resolutions":[{"domain":"api.gofile.io","address":"160.202.167.55","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"bootstrap.pypa.io","address":"151.101.0.175","ttl":20527,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"files.pythonhosted.org","address":"167.82.48.223","ttl":6332,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"flagbrother.uk","address":"45.138.16.202","ttl":300,"country":"Poland","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"pypi.org","address":"151.101.128.223","ttl":12375,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"www.myexternalip.com","address":"34.160.111.145","ttl":35,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"domain":"www.python.org","address":"167.82.48.223","ttl":6629,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"http_requests":[{"host":"pypi.org","host_ip":"151.101.128.223:443","url":"/simple/pythonforwindows/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /simple/pythonforwindows/ HTTP/1.1\nHost: pypi.org\nUser-Agent: pip/26.0 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.0\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: gzip, deflate\nAccept: application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01\nConnection: keep-alive\nCache-Control: max-age=0","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"host":"files.pythonhosted.org","host_ip":"167.82.48.223:443","url":"/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl.metadata","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl.metadata HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.0 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.0\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"host":"files.pythonhosted.org","host_ip":"167.82.48.223:443","url":"/packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /packages/01/3b/bf4a9a401ea2cd867aa4522a97ffa2f5b60a38c3249887f77f0f997d7743/pythonforwindows-1.0.4-py3-none-any.whl HTTP/1.1\nHost: files.pythonhosted.org\nUser-Agent: pip/26.0 {\"ci\":null,\"cpu\":\"AMD64\",\"implementation\":{\"name\":\"CPython\",\"version\":\"3.11.0\"},\"installer\":{\"name\":\"pip\",\"version\":\"26.0\"},\"openssl_version\":\"OpenSSL 1.1.1q 5 Jul 2022\",\"python\":\"3.11.0\",\"setuptools_version\":\"80.10.2\",\"system\":{\"name\":\"Windows\",\"release\":\"10\"}}\nAccept-Encoding: identity\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}],"processes":[{"pid":6256,"ppid":0,"name":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin.exe","command_line":"","sha256":"9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65","normalized_path":"C:\\9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65.bin.exe","uid":"00000000-00006256","icon":"$72"},{"pid":7016,"ppid":6256,"name":"Application.exe","command_line":"","sha256":"0176f0ce62ad61e559a42ef4cfee82c27d928c108c473dea7d7fcc6c37798133","normalized_path":"%TEMP%\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe","parent_uid":"00000000-00006256","uid":"00000000-00007016"},{"pid":7180,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"powershell -Command \"(Get-CimInstance Win32_ComputerSystemProduct).UUID\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00007180"},{"pid":260,"ppid":7180,"name":"powershell.exe","command_line":"powershell -Command \"(Get-CimInstance Win32_ComputerSystemProduct).UUID\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007180","uid":"00000000-00000260"},{"pid":2516,"ppid":7016,"name":"Application.exe","command_line":"\"%APPDATA%\\Application\" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1756,i,7544103548311010564,16161514539485357761,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2","sha256":"0176f0ce62ad61e559a42ef4cfee82c27d928c108c473dea7d7fcc6c37798133","normalized_path":"%TEMP%\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe","parent_uid":"00000000-00007016","uid":"00000000-00002516"},{"pid":2532,"ppid":7016,"name":"Application.exe","command_line":"\"%APPDATA%\\Application\" --field-trial-handle=2216,i,7544103548311010564,16161514539485357761,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3","sha256":"0176f0ce62ad61e559a42ef4cfee82c27d928c108c473dea7d7fcc6c37798133","normalized_path":"%TEMP%\\3CDog4NaSAHpPeWyqcXIvnctUk8\\Application.exe","parent_uid":"00000000-00007016","uid":"00000000-00002532"},{"pid":1180,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"attrib +h +s \"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00001180"},{"pid":8132,"ppid":1180,"name":"attrib.exe","command_line":"attrib +h +s \"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00001180","uid":"00000000-00008132"},{"pid":7436,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"schtasks /query /tn \"MicrosoftUpdateService_sys\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00007436"},{"pid":7716,"ppid":7436,"name":"schtasks.exe","command_line":"schtasks /query /tn \"MicrosoftUpdateService_sys\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00007436","uid":"00000000-00007716"},{"pid":7876,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"schtasks /create /tn \"MicrosoftUpdateService_sys\" /tr \"\\\"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe\\\"\" /sc onlogon /rl highest /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00007876"},{"pid":7856,"ppid":7876,"name":"schtasks.exe","command_line":"schtasks /create /tn \"MicrosoftUpdateService_sys\" /tr \"\\\"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe\\\"\" /sc onlogon /rl highest /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00007876","uid":"00000000-00007856"},{"pid":7572,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"attrib +h \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\MicrosoftUpdateWatcher.vbs\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00007572"},{"pid":7440,"ppid":7572,"name":"attrib.exe","command_line":"attrib +h \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\MicrosoftUpdateWatcher.vbs\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00007572","uid":"00000000-00007440"},{"pid":6492,"ppid":7016,"name":"wscript.exe","command_line":"//B //Nologo \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\MicrosoftUpdateWatcher.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\system32\\wscript.exe","parent_uid":"00000000-00007016","uid":"00000000-00006492"},{"pid":6420,"ppid":6492,"name":"cmd.exe","command_line":"/c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_07055475.txt\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00006492","uid":"00000000-00006420"},{"pid":3580,"ppid":6420,"name":"schtasks.exe","command_line":"schtasks /query /tn \"MicrosoftUpdateService_sys\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00006420","uid":"00000000-00003580"},{"pid":6036,"ppid":6492,"name":"cmd.exe","command_line":"/c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_0533424.txt\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00006492","uid":"00000000-00006036"},{"pid":3708,"ppid":6036,"name":"schtasks.exe","command_line":"schtasks /query /tn \"MicrosoftUpdateService_sys\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00006036","uid":"00000000-00003708"},{"pid":5164,"ppid":6492,"name":"cmd.exe","command_line":"/c schtasks /query /tn \"MicrosoftUpdateService_sys\" > \"%TEMP%\\mswu_05795186.txt\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00006492","uid":"00000000-00005164"},{"pid":3804,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"py -3 -c \"import sys;print(sys.executable)\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00003804"},{"pid":8004,"ppid":3804,"name":"py.exe","command_line":"py -3 -c \"import sys;print(sys.executable)\"","sha256":"dc7585f00e12dc97427a3c98bbf8b09c3498b1e81be2f245a68bac1dae2bf46a","normalized_path":"%WINDIR%\\py.exe","parent_uid":"00000000-00003804","uid":"00000000-00008004"},{"pid":6336,"ppid":8004,"name":"python.exe","command_line":"-c \"import sys;print(sys.executable)\"","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00008004","uid":"00000000-00006336"},{"pid":4748,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" -c \"import Crypto,windows\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00004748"},{"pid":4272,"ppid":4748,"name":"python.exe","command_line":"-c \"import Crypto,windows\"","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00004748","uid":"00000000-00004272"},{"pid":3980,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" -m pip install --quiet --no-cache-dir pycryptodome PythonForWindows\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00003980"},{"pid":8068,"ppid":3980,"name":"python.exe","command_line":"-m pip install --quiet --no-cache-dir pycryptodome PythonForWindows","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00003980","uid":"00000000-00008068"},{"pid":2792,"ppid":8068,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008068","uid":"00000000-00002792"},{"pid":6296,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"\"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe\" -c \"import Crypto,windows\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00006296"},{"pid":1244,"ppid":6296,"name":"python.exe","command_line":"-c \"import Crypto,windows\"","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00006296","uid":"00000000-00001244"},{"pid":620,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"python --version\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00000620"},{"pid":1420,"ppid":620,"name":"python.exe","command_line":"python --version","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00000620","uid":"00000000-00001420"},{"pid":3736,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"python -m pip install --quiet --no-cache-dir pythonforwindows pycryptodome\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00003736"},{"pid":5676,"ppid":3736,"name":"python.exe","command_line":"python -m pip install --quiet --no-cache-dir pythonforwindows pycryptodome","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00003736","uid":"00000000-00005676"},{"pid":1752,"ppid":5676,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005676","uid":"00000000-00001752"},{"pid":6232,"ppid":7016,"name":"cmd.exe","command_line":"/d /s /c \"python \"%TEMP%\\grrpaw.py\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007016","uid":"00000000-00006232"},{"pid":4788,"ppid":6232,"name":"python.exe","command_line":"python \"%TEMP%\\grrpaw.py\"","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00006232","uid":"00000000-00004788"}],"all_imported_dlls":["mscoreei.dll","Microsoft.PowerShell.Security.ni.dll","miutils.dll","libffi-8.dll","shfolder.dll","cldapi.dll","msctf.dll","MpOAV.dll","msisip.dll","combase.dll","oleaut32.dll","System.Management.Automation.ni.dll","psapi.dll","msvcp_win.dll","advapi32.dll","clbcatq.dll","dbgcore.dll","dcomp.dll","sxs.dll","mlang.dll","imm32.dll","FWPUCLNT.DLL","Microsoft.PowerShell.ConsoleHost.ni.dll","mswsock.dll","dhcpcsvc6.dll","mi.dll","ulib.dll","wshext.dll","scrobj.dll","urlmon.dll","dnsapi.dll","System.Core.ni.dll","slc.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","d3dcompiler_47.dll","cryptsp.dll","dpapi.dll","MMDevAPI.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wbemcomn.dll","System.Management.ni.dll","wow64.dll","wow64win.dll","KernelBase.dll","powrprof.dll","Windows.StateRepositoryPS.dll","StdUtils.dll","TextInputFramework.dll","System.Xml.ni.dll","bcryptprimitives.dll","dwmapi.dll","CoreUIComponents.dll","vcruntime140_clr0400.dll","fsutilext.dll","coml2.dll","iertutil.dll","35Y08N8P.dll","msvcrt.dll","userenv.dll","Windows.UI.dll","vbscript.dll","python311.dll","ffmpeg.dll","devobj.dll","mscoree.dll","sppc.dll","ucrtbase.dll","comctl32.dll","setupapi.dll","wintrust.dll","atl.dll","clrjit.dll","msIso.dll","rpcrt4.dll","cryptbase.dll","apphelp.dll","System.Configuration.ni.dll","wldp.dll","wbemsvc.dll","System.Transactions.ni.dll","mfplat.dll","libEGL.dll","Microsoft.Management.Infrastructure.ni.dll","uxtheme.dll","System.dll","winmm.dll","wtsapi32.dll","kernel32.dll","System.Data.ni.dll","imagehlp.dll","winhttp.dll","nlaapi.dll","wbemprox.dll","d3d10warp.dll","edputil.dll","windows.storage.dll","System.Transactions.dll","fastprox.dll","mf.dll","libGLESv2.dll","gdi32.dll","cfgmgr32.dll","ws2_32.dll","propsys.dll","bcrypt.dll","Microsoft.Management.Infrastructure.CimCmdlets.ni.dll","vk_swiftshader.dll","sspicli.dll","mscorlib.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","dxgi.dll","gpapi.dll","System.Numerics.ni.dll","scrrun.dll","shell32.dll","oleacc.dll","d3d11.dll","clr.dll","SHCore.dll","sechost.dll","VxSSL32.dll","WinTypes.dll","System.Data.dll","version.dll","nsis7z.dll","dhcpcsvc.dll","ResourcePolicyClient.dll","RTWorkQ.dll","mpr.dll","libssl-1_1.dll","amsi.dll","shlwapi.dll","aepic.dll","IPHLPAPI.DLL","rsaenh.dll","winsta.dll","gdi32full.dll","crypt32.dll","msasn1.dll","rasadhlp.dll","CoreMessaging.dll","wmidcom.dll","taskschd.dll","xmllite.dll","profapi.dll","fltLib.dll","ntmarta.dll","VxSSL64.dll","MpClient.dll","OneCoreUAPCommonProxyStub.dll","python3.dll","libcrypto-1_1.dll","ntshrui.dll","winmmbase.dll","secur32.dll","ucrtbase_clr0400.dll","vcruntime140.dll","System.DirectoryServices.ni.dll","user32.dll","ole32.dll","dbghelp.dll","DWrite.dll","nsi.dll","KBDUS.DLL","mscms.dll","System.ni.dll","kernel.appcore.dll","wow64cpu.dll","win32u.dll","System.Configuration.Install.ni.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Application.exe","sha256":"15a87dd80e662d152be2a1be97005fe0cff6b92ad4bf15f2daab4732f6c412b7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"MicrosoftUpdate.exe","sha256":"b78da64687ee2d7801df0b572314eeffbae670095656005b25adaf86c6469cf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"ffmpeg.dll","sha256":"fbaecaf7e583390a6c36997379fadee0573bc6dde77a580704b8c54a0d5fd0c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"libEGL.dll","sha256":"861036b8cd55f521b0c92a52994bf2be950177a104d6665981e99584de61c0c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"libGLESv2.dll","sha256":"d68ff74c5e619ee4e73afefd9a4f8d7429e65cbb2a9c28d6cc846e7fce18185c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"libvips-42.dll","sha256":"30d56963aca3ce41f7517ce97130b4bc82c1283b078d0f6015d89c032ec9ff4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"libvips-cpp-8.17.3.dll","sha256":"f1b3c3eeea1b6a8292a69d78dd2cd1debacb9951cabdd9217a57e34137570cd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"vk_swiftshader.dll","sha256":"aa2c7d5e0f2967bb7fe80a56ff66b2ee6197a43fa4fd130f5ff5cf09d0b2ad35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"vulkan-1.dll","sha256":"36c863d5f03bc393db8eb313578fb6d8d11b0e63dc7ba8f807034eb59c1350bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"__init__.py","sha256":"1ea9f7746867515d4c723f4a29b2ddb6be8871b94a3229c666900aeda86220aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"alpc.py","sha256":"945a9269abb4c75e3998912989df3307db16b48bfdfc8fa851907bd0f25c5f7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"com.py","sha256":"36af816cb7e766dfc40543370d2829799abc763b42f938e0fa055aeba7bd0c57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"catalog.py","sha256":"c8a21c7795bb68289d54c98a0f55d8678139009ec87ae93c99847ed806378843","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"certificate.py","sha256":"ac65ea65e1c4900592e8d6665b77ea5949e238f185442688ccdad5ca9353624a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"cryptmsg.py","sha256":"3174b2cd7c348af02b61a54e4a2db99e07154379cde9e288941f59b37827ae9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"dpapi.py","sha256":"54f8d1dd94c579f60ee6535660fdf3a6a9c780ad7e053baf3777ea32a0813202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"encrypt_decrypt.py","sha256":"26fd0278f1b036f3981e8c16cd493d53d8d57af7918f56fa44bcf1913a98d063","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"generation.py","sha256":"99eb4aafe451ba388635f4dbb2eded997cfd00865ccbe7436416038bc857ec7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"sign_verify.py","sha256":"c6fe4a6dd2e0180316b5953a905d2dcf21f9c8de2fc670a1b42f8f2b90a2a830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"breakpoints.py","sha256":"142b807b418987d7b6874391bf5c8db9e60651cc24ed5907379446a8f2367d20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"debugger.py","sha256":"811c75d7d201c4352b00730db2cebb6a59d4b41705518ca6d4e2b2f2c64df1d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"localdbg.py","sha256":"bdad7d821d215266149544880231ff91f064bc358515c40bdc505660d414cd74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"symboldbg.py","sha256":"6774ee7f9b2034eddfa020915181f509d9fd0e8d5f2ce086f6d2c3bc867beb86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"symbols.py","sha256":"99aa6d061a06c833807b2d08bfccd27cc608ec6fb4d7bf32763dacd240ebb31b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"flag.py","sha256":"3621280dd580aaabcf73628d4f182730f38e10423090e3a2e5ae14e84b441e53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsdE851.tmp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\prebuilds","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\build","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\lib","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\src","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\sharp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\vmdetector","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\vmdetector\\build","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\colour","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\colour\\color.cjs","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\colour\\index.cjs","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\colour\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\colour\\package.json","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64\\lib","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64\\lib\\sharp-win32-x64.node","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64\\LICENSE","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64\\package.json","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@img\\sharp-win32-x64\\versions.json","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\dpapi.vcxproj","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\dpapi.vcxproj.filters","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\dpapi.exp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\dpapi.iobj","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\dpapi.ipdb","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\dpapi.lib","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\dpapi.node","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.node.recipe","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\CL.command.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\CL.read.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\CL.write.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\dpapi.lastbuildstate","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\dpapi.write.1u.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\link.command.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\link.read.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\build\\Release\\obj\\dpapi\\dpapi.tlog\\link.write.1.tlog","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\dist","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\dist\\index.js","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\LICENSE","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\package.json","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\prebuilds\\win32-arm64","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\prebuilds\\win32-arm64\\@primno+dpapi.node","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\prebuilds\\win32-x64","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\prebuilds\\win32-x64\\@primno+dpapi.node","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\src","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\src\\dpapi_addon.h","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\src\\dpapi_not_supported.cpp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\src\\dpapi_win.cpp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@primno\\dpapi\\src\\main.cpp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\build\\Release","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\build\\Release\\better_sqlite3.node","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\common.gypi","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\copy.js","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\defines.gypi","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\download.sh","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\patches","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\patches\\1208.patch","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\sqlite3","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\sqlite3\\sqlite3.c","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\sqlite3\\sqlite3.h","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\sqlite3\\sqlite3ext.h","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\sqlite3.gyp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\deps\\test_extension.c","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\nsoE891.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\better-sqlite3\\lib\\database.js","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"pipe\\uv\\FFFFFFFFFFFFFFFF-7016","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"pipe\\uv\\0000000000000000-7016","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"pipe\\uv\\0000000000000001-7016","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"pipe\\mojo.7016.4448.17914536889060839646","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%APPDATA%\\Application\\aa41c333-8b43-4194-9db0-c9fe1a31fd09.tmp","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"pipe\\mojo.7016.4448.14796146711722989850","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Fonts\\MicrosoftUpdate.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\MicrosoftUpdateWatcher.vbs","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\MicrosoftServicingDevicingService\\flag_31459921","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\grrpaw.py","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_j30c0gwy.voz.ps1","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_airc4dgj.4qu.psm1","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\mswu_07055475.txt","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"path":"%TEMP%\\mswu_0533424.txt","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:6256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:6256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:6256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:260:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:260:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:2516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:2516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6492:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:6492:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:6492:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:6492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:6492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6492:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:8068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:8068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]},{"name":"Local\\SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e002deeb2fd22c43031070"}]}]}},"report_ids":{"sandbox_job_ids":["69e002deeb2fd22c43031070"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 9f9c4d0f6644… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9f9c4d0f6644…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 9f9c4d0f6644… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9f9c4d0f6644…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 9f9c4d0f6644… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9f9c4d0f6644…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]